1. Make sure your system is reachable from the Internet for validation.

host -t A service1.example.com
service1.example.com has address 1.2.3.4

2. Open the App Settings below. Set your desired domain(s) and services and click "Save changes". You can check if the certificate has been obtained successfully by checking the "Status" field in the App Settings approx. 10 seconds afterwards.

3. Once the certificate has been configured, you need to restart the desired services via the "System services" module in the UMC. This is only required during setup. The automatic renewal mechanism restarts the services if needed.
If you want to change the hostname in the certificate later on, just change the configuration in the App Settings and save.
In certain scenarios, which incorporate NAT, or cloud environments like AWS, the internal domain verification of the App might fail, despite the DNS being configured correctly and Let's Encrypt being able to issue a certificate for the server.
In these cases, adding a manual DNS entry on the system running the Let's Encrypt App can help:

ucr set hosts/static/<EXTERNAL-IPADDRESS>=<LETS-ENCRYPT-HOSTNAME>

If you encounter problems with the obtained certificate, please have a look at the status of the App via the App Settings page and the log file /var/log/univention/letsencrypt.log. All actions of the app are written to this log file. Also, refer to the "Troubleshooting" section in the original article about Let's Encrypt in the Univention Wiki.