docker run -it --rm \
-v /docker/volumes/etc/letsencrypt:/etc/letsencrypt \
-v /docker/volumes/var/lib/letsencrypt:/var/lib/letsencrypt \
-v /docker/volumes/var/log/letsencrypt:/var/log/letsencrypt \
certbot/certbot \
certonly --manual \
--preferred-challenges dns-01 \
--server https://acme-v02.api.letsencrypt.org/directory \
--register-unsafely-without-email --agree-tos \
--manual-public-ip-logging-ok \
-d example.com -d *.example.com

(c) https://habr.com/post/413017/