Certbot obtain / renew manual (letsencrypt - wildcard)

If you’d like to obtain a certificate running certbot on a machine other than your target webserver or perform the steps for domain validation yourself, you can use the manual plugin. While hidden from the UI, you can use the plugin to obtain a certificate by specifying certonly and --manual on the command line. This requires you to copy and paste commands into another terminal session, which may be on a different computer.

To manually renew a certificate using --manual without hooks, repeat the same certbot --manual command you used to create the certificate originally. As this will require you to copy and paste new HTTP files or DNS TXT records, the command cannot be automated with a cron job.

The manual plugin can use either the http or the dns challenge. You can use the --preferred-challenges option to choose the challenge of your preference.

I prefer to use dns, so it would look like:

One certificate:

certbot -d www.vindazo.ru --key-path ./cert.key --csr ./cert.csr --manual --preferred-challenges dns certonly

WILDCARD certificates, we use `*`:  

certbot -d *.jobsite.hr --key-path ./cert.key --csr ./cert.csr --manual --preferred-challenges dns certonly

The * wildcard character is treated as a stand-in for any hostname. This example DNS record would match one.example.com, and two.example.com. It would not match the bare example.com nor would it match one.two.example.com because the * wildcard will only expand to one hostname, not to multiple levels of names.

Additionally a wildcard DNS record can only have one wildcard character, so *.*.example.com is not allowed.

The http challenge will ask you to place a file with a specific name and specific content in the /.well-known/acme-challenge/ directory directly in the top-level directory (“web root”) containing the files served by your webserver. In essence it’s the same as the webroot plugin, but not automated.

When using the dns challenge, certbot will ask you to place a TXT DNS record with specific contents under the domain name consisting of the hostname for which you want a certificate issued, prepended by _acme-challenge.

For example, for the domain example.com, a zone file entry would look like:

_acme-challenge.vindazo.ru. 300 IN TXT "gfj9Xq...Rg85nM"

To check dns record, we can use dig:

dig _acme-challenge.www.vindazo.ru txt +short

The certbot produced 3 files 0000_cert.pem, 0000_chain.pem, 0001_chain.pem.

Let’s explain those files:

• The "0000_cert.pem" file is the actual certificate (called public key).
• The "0000_chain.pem" file is the CA certificate also called “Intermediate Certificate / CA bundle”.
• The "0001_chain.pem" file is a concatenation of the two above files.

Source:
    https://eff-certbot.readthedocs.io/en/stable/using.html#manual
    https://eff-certbot.readthedocs.io/en/stable/using.html#where-are-my-certificates