I\’m not quite sure jdavey quite understands the depth of the question.
SSL Certificates from Lets Encrypt, are issues on a 90 day cycle and require someone with SU access on the server to issue the installation command of sites that have been approved into its beta program (soon to be a public beta).
In this case, one of the Site5 admins would need to run a python script (there are several version available, they call them ACME Clients) to install and automate the installation of the SSL certificate.
The advantage to site 5 in this case is that it only needs to be set up once, and the script will handle the rest, automatically verifying and renewing the SSL installation on the server end.