@prettygood @Paradox yeah, nginx-acme it relatively recently went mainline(? i think its considered that at least)
and i do use its generated certs for a couple other services, the filenames are static (though, it's undocumented.. iirc think the next major release'll have it change once more, then stay that way (if it hasn't already happened))
then, just a matter of making sure the machine reboots every so often to restart services, which happens anyways for updates in my case