If you want the easy way but you are not using certbot you are doing it (quite possibly, you know, given the requirements, but your milage my vary anyway so oh wait this is becoming a disclaimer or what) wrong.