have a look into the API for LE, you will find very quickly we can not do this for you as we dont control your DNS and they only support it if port 80 would be accessible to the web server. As this is all not possible this can not be done by 3CX to ensure reliability.
Also LE certs only last 90 days, so they need to be renewed, we do this for our certs, you would need to do this on your own.
So, just use a 3CX domain. Personally, I wrote a year ago a guide on how to use your own cert on your own domain.
A year later my cert run out of time and I was due to pay and wondered why I shall do it and switched to a 3CX domain and all was fine.
Hassel free...