diff --git a/group_vars/certbot.yml b/group_vars/certbot.yml
index a10d64259a2c41ca6da71b83dc567338bafff893..7540ee94883090c0463286c10e4be3a719db4d05 100644
--- a/group_vars/certbot.yml
+++ b/group_vars/certbot.yml
@@ -5,4 +5,4 @@ glob_certbot:
     dns_rfc2136_secret: "{{ vault.certbot_dns_secret }}"
     mail: root@crans.org
     certname: crans.org
-    domains: "crans.org"
+    domains: "*.crans.org"
diff --git a/host_vars/hodaur.adm.crans.org.yml b/host_vars/hodaur.adm.crans.org.yml
index 674f1a2ddee40c8c0ca415f02f99f013ee56a5c4..53d3a98a63a5a588ccdc109e84b1082b780f441b 100644
--- a/host_vars/hodaur.adm.crans.org.yml
+++ b/host_vars/hodaur.adm.crans.org.yml
@@ -2,11 +2,3 @@
 interfaces:
   adm: ens18
   srv: ens19
-
-loc_certbot:
-  - dns_rfc2136_server: '172.16.10.147'
-    dns_rfc2136_name: certbot_challenge.
-    dns_rfc2136_secret: "{{ vault.certbot_dns_secret }}"
-    mail: root@crans.org
-    certname: crans.org
-    domains: "crans.org, *.crans.org, crans.fr, *.crans.fr, crans.eu, *.crans.eu"
diff --git a/host_vars/irc.adm.crans.org.yml b/host_vars/irc.adm.crans.org.yml
index dfb6def1da4a7dced0d62cda5ce0be4e3b524f05..b75e160f2bb0050adfab12fe1014ba172ca0aa2b 100644
--- a/host_vars/irc.adm.crans.org.yml
+++ b/host_vars/irc.adm.crans.org.yml
@@ -3,14 +3,6 @@ interfaces:
   adm: ens18
   srv: ens19
 
-loc_certbot:
-  - dns_rfc2136_server: '172.16.10.147'
-    dns_rfc2136_name: certbot_challenge.
-    dns_rfc2136_secret: "{{ vault.certbot_dns_secret }}"
-    mail: root@crans.org
-    certname: crans.org
-    domains: "irc.crans.org"
-
 loc_nginx:
   service_name: "thelounge"
   servers:
diff --git a/host_vars/redisdead.adm.crans.org.yml b/host_vars/redisdead.adm.crans.org.yml
index f562ec360aba3bb7e26b649dd83ccf1312e22cf9..8228a1d0f68dc4a674859cef562009440f788244 100644
--- a/host_vars/redisdead.adm.crans.org.yml
+++ b/host_vars/redisdead.adm.crans.org.yml
@@ -33,11 +33,3 @@ to_backup:
   secrets_file: "/etc/rsyncd.secrets",
   hosts_allow: ["zephir.adm.crans.org", "10.231.136.6"],
   }
-
-loc_certbot:
-  - dns_rfc2136_server: '172.16.10.147'
-    dns_rfc2136_name: certbot_challenge.
-    dns_rfc2136_secret: "{{ vault.certbot_dns_secret }}"
-    mail: root@crans.org
-    certname: crans.org
-    domains: "*.crans.org"
diff --git a/roles/certbot/tasks/main.yml b/roles/certbot/tasks/main.yml
index 91e2fde88b64b661c3255bda72f48fa51583b93e..eb50fc023f945fc367812c07e9e7a4e687753639 100644
--- a/roles/certbot/tasks/main.yml
+++ b/roles/certbot/tasks/main.yml
@@ -10,13 +10,6 @@
   retries: 3
   until: apt_result is succeeded
 
-- name: Lookup DNS masters IPv4
-  set_fact:
-    #dns_masters_ipv4: "{{ bind.masters | json_query('servers[].interface[?vlan_id==`2`].ipv4[]') }}"
-    dns_masters_ipv4:
-      - "172.16.10.147"
-    cacheable: true
-
 - name: Add DNS credentials
   template:
     src: letsencrypt/rfc2136.ini.j2
@@ -45,6 +38,8 @@
 
 - name: Run certbot
   command: certbot --non-interactive --config /etc/letsencrypt/conf.d/{{ item.certname }}.ini certonly
+  register: certbot_output
+  changed_when: not "Certificate not yet due for renewal" in certbot_output.stdout
   loop: "{{ certbot }}"
 
 - name: Clean old files