By my memory, a cron runs a script that checks my cert file's last modified daily. When it is a certain number of days since (flavored Bash statements) the file last modified I'll certbot and install whatever comes back.

It's very under-engineered, maybe a trifold pamphlet on light A11 printed with a laser jet running out of ink.

I've probably spent more time talking about how much it sucks than I have bothered considering a proper solution, at this point.