I got a free cert from zeroSSL but you do have to manually install them; not that hard at all. For Nginx you have to have a combined file which you generate by this command at a shell prompt (or you can do it manually in a txt editor as well) cat certificate.crt ca_bundle.crt >> certificate.combined. I added a cname they provided to the DNS for verification of the site.
However, look at the prices at https://www.ssls.com/ It might just be better to buy a cert for a year and not worry about this 90 day expiration.