Why couldn't you instead have a deployment process that includes calling certbot automatically for the new domain then? Since the domain is likely ICANN registered right.
EDIT: it's common courtesy to explain why you downvote a post, as it stands I'm going to make the assumption the downvoters are simply too lazy to do things properly.
EDIT: it's common courtesy to explain why you downvote a post, as it stands I'm going to make the assumption the downvoters are simply too lazy to do things properly.