Citadel does this only for internal certa. It does not provision lets encrypt (at least didn’t several months ago)