Assuming you have your virtual domains set up, let's get them set up so they are serving with secure SSL certificates, and set to automatically update.
First we want to make sure snapd is updated on our server:
$ sudo snap install core; sudo snap refresh core
Next we install Certbot, which will manage our certificate(s)
$ sudo snap install --classic certbot
$ sudo ln -s /snap/bin/certbot /usr/bin/certbot
And finally run it to get our certificate(s)
$ sudo certbot --apache
The script will now ask you to continue, agree to the condisions, and offer to add you to their email list. Finally, it will check to see what sites you have enabled in Apache, and ask you which ones you want to install the certificates for.
As long as your DNS is set up correctly for the websites, it will automatically generate the certificates, save them, and apply any changes to your Apache configuration files. You should be good to go within a minute.