I would prefer to not manage them at all. Let my cloud provider care about SSL (AWS already provides it). I don't even want anyone (including me) to have acces

I would prefer to not manage them at all. Let my cloud provider care about SSL (AWS already provides it). I don't even want anyone (including me) to have access to our SSL certificates. There's no lock-in, I can always change my mind and buy new SSL certs somewhere else.