[emurray]

It involves using "certbot certonly -a manual" with a bunch of other flags on the command line (well in a script really), create the file it asks for and let it generate a new key.

Gitlab pages only lets you add cert/key details at the point you add the domain (afaik anyway), so you need to delete it and re-add it with the renewed key. It's tedious enough, but it's really only the last step that needs to be done manually.

[james-skemp]

I think there's an issue to make this easier, but I finally just bit the bullet and threw Cloudflare in front of it.

I really hope that GitLab will simplify this, especially with Chrome soon warning on any HTTP site.