Renew a wildcard certificate using certbot

certbot-wildcard.sh

#!/bin/bash
set -xe

export domain='change.me'

certbot --config ./cli-certbot.ini certonly -d "*.$domain"
# Follow the instructions.

ansible-vault encrypt "./tmp/config/live/$domain/privkey.pem" --output "./${domain}_privkey.pem.vault"
cat "./tmp/config/live/$domain/fullchain.pem" > "./${domain}_fullchain.pem"

find ./tmp -type f -name '*key*' -exec chmod -v u+w '{}' \; -exec shred -v '{}' \; && rm -r ./tmp

# deploy the certificate all over your infrastructure

cli-certbot.ini

email = change@me.please

config-dir=./tmp/config
work-dir=./tmp/work
logs-dir=./tmp/logs

no-eff-email = true
agree-tos = true
manual = true
preferred-challenges = dns