It sounds like you may need a step in between the issuance and when Kestrel picks up the latest cert.
That step can simply copy the symlinked files to a standard location for Kestrel to pick them up [overwriting the previous files].
Those kinds of "steps" are known as hooks.
In this case, you best choice would be a deployment hook [which would only kick in when a cert is actually renewed - not everytime the client is run].
1 Like