See:
https://certbot.eff.org/lets-encrypt/centosrhel7-nginx

CentOS 7
------------
You can install EPEL by running == yum install epel-release ==. The package is
included in the CentOS Extras repository, enabled by default.

CentOS 8
-------------
dnf config-manager --set-enabled PowerTools

===>
yum -y install yum-utils
yum-config-manager --enable rhui-REGION-rhel-server-extras rhui-REGION-rhel-server-optional
sudo yum install certbot python2-certbot-nginx

===WARN==
sudo pip uninstall requests
sudo pip uninstall urllib3
sudo yum reinstall python-urllib3
sudo yum reinstall python-requests

===>
sudo certbot --nginx

===> 定时renew证书
echo "0 0,12 * * * root python -c 'import random; import time; time.sleep(random.random() * 3600)' && certbot renew -q" | sudo tee -a /etc/crontab > /dev/null