Renew_before_expiry : cli.ini

I don’t think there is actually a way to control this globally. There is an open PR for it, which is a pretty good sign that doesn’t exist yet.

You might have to just sed yourself there instead:

sed -i 's/renew_before_expiry = .*/renew_before_expiry = 1 week/' /etc/letsencrypt/renewal/*.conf