If you are using your own certificate to enable HTTPS on a custom domain, you must use an allowed certificate authority (CA) to create it.

Last updated: Feb 7, 2020 Root Certificates Our roots are kept safely offline. We issue end-entity certificates to subscribers from the intermediates in the next section.
Active  ISRG Root X1 (self-signed)    We’ve set up websites to test certificates chaining to our roots.
ISRG Root X1 Valid Certificate  https://valid-isrgrootx1.letsencrypt.org/   ISRG Root X1 Revoked Certificate  https://revoked-isrgrootx1.letsencrypt.org/   ISRG Root X1 Expired Certificate  https://expired-isrgrootx1.