I renew it automatically via DNS. But as I use Cloudflare for DNS, and it doesn't allow to precisely control access to subdomains, I use a separate locked down VM that is only responsible for issuance and makes the resulting certs available for download.