sudo apt install snapd

sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/bin/certbot

sudo certbot certonly  -d "*.chancel.me","chancel.me" --manual --preferred-challenges dns

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Requesting a certificate for *.chancel.me

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please deploy a DNS TXT record under the name:

_acme-challenge.chancel.me.

with the following value:

asdf3rfcsadfluJSDDFff3cczKNc2CplQasd3fFDF3fdsd

Before continuing, verify the TXT record has been deployed. Depending on the DNS
provider, this may take some time, from a few seconds to multiple minutes. You can
check if it has finished deploying with aid of online tools, such as the Google
Admin Toolbox: https://toolbox.googleapps.com/apps/dig/#TXT/_acme-challenge.chancel.me.
Look for one or more bolded line(s) below the line ';ANSWER'. It should show the
value(s) you've just added.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Press Enter to Continue

dig -t txt _acme-challenge.chancel.me @8.8.8.8

; <<>> DiG 9.11.3-1ubuntu1.8-Ubuntu <<>> -t txt _acme-challenge.chancel.me @8.8.8.8
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 37425
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;_acme-challenge.chancel.me.    IN      TXT

;; ANSWER SECTION:
_acme-challenge.chancel.me. 3600 IN     TXT     "asdf3rfcsadfluJSDDFff3cczKNc2CplQasd3fFDF3fdsd"

;; Query time: 29 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Thu Aug 04 16:43:13 CST 2022
;; MSG SIZE  rcvd: 111

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/chancel.me/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/chancel.me/privkey.pem
This certificate expires on 2022-03-29.
These files will be updated when the certificate renews.

/etc/letsencrypt/archive/chancel.me
├── cert1.pem
├── chain1.pem
├── fullchain1.pem
└── privkey1.pem

sudo openssl x509 -in  /etc/letsencrypt/archive/chancel.me/cert1.pem -noout

Certificate:
    Data:
        Version: 3 (0x2)
        ...
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
                ...
            X509v3 Subject Alternative Name: 
                DNS:*.chancel.me

sudo certbot certonly --nginx

Which names would you like to activate HTTPS for?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: chancel.me
2: api.chancel.me
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel): 2
Requesting a certificate for chancel.me

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/api.chancel.me/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/api.chancel.me/privkey.pem
This certificate expires on 2022-03-30.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
 * Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
 * Donating to EFF:                    https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

/etc/letsencrypt/archive/api.chancel.me
├── cert1.pem
├── chain1.pem
├── fullchain1.pem
└── privkey1.pem

0 directories, 4 files

Certificate:
    Data:
        Version: 3 (0x2)
        ...
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
                ...
            X509v3 Subject Alternative Name: 
                DNS:chancel.me

0 3 15 */1 * /usr/bin/certbot renew --dry-run

sudo certbot certificates

sudo certbot -d api.chancel.me delete

server {
    listen 443 ssl;
    server_name www.chancel.me; 
    ssl_certificate /etc/letsencrypt/archive/chancel.me/fullchain1.pem;
    ssl_certificate_key /etc/letsencrypt/archive/chancel.me/privkey1.pem;
    ssl_session_timeout 5m;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2; 
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
    ssl_prefer_server_ciphers on;

    location / {
        ...
    }
}