Let's Encrypt

Thingie to get SSL certificates

Automatic renewal setup

Just enable the certbot.timer in Debian or certbot-renew.timer on Arch Linux.