One option to consider is using Cloudflare's Origin CA Certificate. You get one from Cloudflare and you can set the expiration period for a long time.
You would not even have to bother installing Certbot and getting a Let's Encrypt cert. There are some limitations such as what ports are allowed but if you are just doing common things it might work very well you.
See