Issue SSL (Let's encrypt) for customer domains

I'm working on a project where clients can link a subdomain via CNAME to my server and show their content. I'd like to issue a Let's Encrypt Certificate to that specific subdomain so the client / customer won't have to. Since doing this manually would be a big overload, I would need a solution that works with either Cloudflare or AWS.

To be honest, I know this is possible, but I have no idea where to start. I assume the client would have to set two domain records (CNAME as mentioned above, plus a second one) for this to be possible.

Would be really helpful to have some insights, maybe even some sort of tutorial / manual regarding this. And help or tip is much appreciated.