LetsEncrypt dilemma

I have a Windows Web-server and a DS413j behind a Cisco ASA. The webserver hosts my private web-service and is already covered by LetEncrypt by [https://github.com/PKISharp/win-acme](https://github.com/PKISharp/win-acme)

But I want to add a certificate to my Synology that's hosting my low-volume personal email service, the IMAP-service to be exact.

External port 80 goes to my internal webserver.External port 443 goes to my internal webserver.External port 993 goes to my internal NAS (but fails unless I manually import the right certificate)

My dilemma is this: Since LetsEncrypts challenges go to my webserver (both 80 and 443), the applet in my DSM always fails on the creation of a certificate. Temporarily flipping port-forwarding to my NAS works, but I dont want to have to change my Firewall-config every 2-3 months because I'm manually renewing certificates. I can already create, export from windows and import a working cert via OpenSSL-tools, and it seems to work

Question: Can I automate imports and service-assignments of a certificate, if I can manage to issue the right name to my webserver?