It involves using "certbot certonly -a manual" with a bunch of other flags on the command line (well in a script really), create the file it asks for and let it generate a new key.

Gitlab pages only lets you add cert/key details at the point you add the domain (afaik anyway), so you need to delete it and re-add it with the renewed key. It's tedious enough, but it's really only the last step that needs to be done manually.