I used to use letsencrypt until the dependencies became too onerous to keep straight and upgrades to letsencrypt resulted in several breaks in my certificate renewal cronjob (nothing major, just changes in how switches behaved). I've since switched to dehydrated and haven't had a problem since.