Get a free 90-day TLS certificate from Let's Encrypt — keys are generated in your browser and never leave your device. You'll need to prove you control the domain (a file on your web server or a DNS record).
Certificates are issued by Let's Encrypt via the ACME protocol. Keys are generated locally with the WebCrypto API and never leave your device.