sudo certbot certonly --nginx --cert-name example.com -d example.com -d www.example.com

certonly obtains certificates without touching nginx site config — the --nginx flag only handles the ACME challenge, while the -d flags list every domain to cover (example.com and www.example.com become SAN, subject-alternative-name entries). --cert-name gives the bundle a stable name for later renew --cert-name calls. Renewal continues automatically via the timer.