http://certbot.iykpqm7jiradoeezzkhj7c4b33g4hbgfwelht2evxxeicbpjy44c7ead.onion/fa/faq
The packaged versions of Certbot are more flexible, and some of the teams building these packages are working toward having Cerbot run with group rather than root privileges where possible. Can I use an existing private key or Certificate Signing Request (CSR) with Certbot? Yes. You can obtain a certificate for an existing CSR, which means you may generate your own CSR using your own private key.