You can configure certbot to write in a directory directly and it won't touch your web server config.