Solution identified!
First off, I could not find any free option to obtain an SSL certificate. I ended up choosing a cheap option ($2/month) offered through noip.com, called No-IP Vital Encrypt DV.
With regard to creating the CSR for my server, win-acme would not generate a certificate with the proper SHA256 encryption signature. Or I couldn't figure it out, I did pop into its settings.json and successfully changed the RSA encryption level to 2048 bits per noip's requirements but could not find signature settings.
I then tried Windows IIS-10 which was a bust.
So I finally found an article on how to use MMC (Microsoft Management Console). It was not at all intuitive, and as with many other how-to sites it assumed a lot of pre-knowledge on SSLs and CSRs, but my prior knowledge gathered from trying the other approaches kicked in and allowed me to complete a CSR that noip's SSL option accepted.
My hostname is now SSL-encrypted!
Ironically, however, one of the reasons I really wanted to do this was to access my home server from work. Sadly, their firewall restrictions would not allow my little https domain to connect! Given my business is in bed with Microsoft (who isn't) and remotewebservices.com is a Microsoft domain, this must have been allowed and was why Essentials allowed me to connect (both for RDP and to access files on my server's share folders).
So, for file access I have enlisted the help of a QNAP NAS, which CAN be accessed from my place of work. Downloads are much slower than from remote web services, but this is the MAIN thing I really needed.