certbot doesn't update certificate CN when hostname changes

[will-emmerson]

This may be a bit of an edge case, but if you decide to change the hostname (which is picked up from inventory) then the certifcate CN won't actually change. I was able to fix this by changing certbot script to use --force-renew temporarily but not sure this would make sense permanently.