While I do not know the full potential of this, apparently certbot is the way to go for refresh services: https://certbot.eff.org/
In our prod we use https://github.com/GUI/lua-resty-auto-ssl to generate over 1k lets encrypt certs that refresh as they expire.
Hope these can help