Let's Encrypt requires a bit of initial configuration.

First of all, the system must be reachable from the Internet for validation! To verify that, the host command may be used.

host -t A service1.example.com
service1.example.com has address 1.2.3.4

To configure the service, switch to the App Settings below. Set your desired domain(s) and services and click "Save changes". The configured services will be restarted, once the certificate has been obtained and configured.

The app always starts obtaining a new certificate when changes are saved! Once the certificate is successfully obtained, Let's Encrypt is fully set up and renews the certificate on it's own.

If you want to change the hostname in the certificate later on, just change the configuration in the App Settings and save.
 
In certain scenarios, which incorporate NAT, or cloud environments like AWS, the internal domain verification of the App might fail, despite the DNS being configured correctly and Let's Encrypt being able to issue a certificate for the server.
In these cases, adding a manual DNS entry on the system running the Let's Encrypt App can help:

ucr set hosts/static/<EXTERNAL-IPADDRESS>=<LETS-ENCRYPT-HOSTNAME>

If you encounter problems with the obtained certificate, please have a look at the status of the App via the App Settings page and the log file /var/log/univention/letsencrypt.log. All actions of the app are written to this log file. Also, refer to the "Troubleshooting" section in the original article about Let's Encrypt in the Univention Wiki.