One of your next steps should be to automate the renewals. Feel free to ask for help (should you need any) once you have decided to do that (or with anything else related that presents you with any challenge).
If you can "somehow run certbot", then you do "control it" (enough).
You question has been answered.
But here it is again (in another way): There is no requirement to change a CSR.
So you are free to use it as many times as needed.
The only requirement is that it (still) contain the list or FQDNs that need to be on the new cert.
AND, I suppose, at some point in time (as with all things) the security/encryption of the CSR itself may become obsolete and may need to be redone.
[Like with SHA-1, SSL3, TLSv1, CRC, WEP, 3DES, MD5 (or any other outdated protocol). Time turns all secure things insecure]
@rg305 Yes, I can "somehow run certbot" but never said I am running it on the target server which I don't control; In fact I am running it on a linux machine, generating the certs on it, and pasting the certs manually on the target server.
But thanks for your input and @danb35; It will probably be easier to just generate a new CSR and use exactly the same command which worked before; (Because to renew using the same CSR I guess the certbot options are different, and probably that adventure will turn out to be another time sink).
I understand better now.
But you can still automate the Linux process. certbot would know when the cert needs to be renewed and can do that part for you (using any automated method you can think of).
And it may also be configured to trigger a script to send you an email notification of such renewals.
So that you know when you need to copy paste the cert manually.
In short: If you got certbot to issue a cert using your own CSR even once, then you can do those exact same steps again (and again ...)
You should also be able to program those step(s) on a schedule.
Teach certbot and let it do the work for you
Once you have issued a cert, certbot will learn how and remember those last settings (in the renewal config file).
It will also usually setup a cron job (or systemd timer) to automatically check all your certs for expiry.
Have a look at any file(s) in folder: /etc/letsencrypt/renewal/
and the output of: certbot certificates
and the output of: crontab -l systemctl list-timers | grep certbot
Then you haven't learned all the tricks for that system.
For instance, is there a ways to share a cert from one Windows server to another? (yes, of course)
But if they each make CSRs, their private keys are different and a single cert won't fit both requests.
So you can treat even a single server as the second server and process the CSR elsewhere.
EDIT: Sorry you have mentioned that you have very little access to the Windows server - I keep forgetting... I wonder if I'm getting old? LOL
