Obtain (and later renew) a TLS certificate using the lego CLI's run command with --email and --domains, via either the HTTP-01 or DNS-01 (Cloudflare) challenge, and locate where lego stores the resulting certificate files.

Documented steps

1. Install lego: download a pre-built binary for your OS from the GitHub releases page (linked from the lego docs) and put it on PATH, or build from source per the Installation guide.
2. HTTP-01 challenge using lego's built-in server (needs to bind port 80): lego run -d 'example.com' --email you@example.com --accept-tos --http
3. If an existing web server already owns port 80, write the challenge file into its webroot instead of starting lego's server: lego run -d 'example.com' --email you@example.com --accept-tos --http --http.webroot /path/to/webroot
4. Wildcard cert via DNS-01 with Cloudflare as the example provider (v5 CLI syntax puts --dns/-d as flags of the run subcommand): CLOUDFLARE_EMAIL="you@example.com" CLOUDFLARE_API_KEY="yourprivatecloudflareapikey" lego run --dns cloudflare -d 'example.org' -d '*.example.org' --email you@example.com --accept-tos
5. Certificates land in ./.lego/certificates/ under the current working directory: example.com.crt (fullchain), example.com.key (private key), example.com.issuer.crt (CA cert), example.com.json (metadata); wildcard filenames replace the leading '*' with '_', e.g. _.example.com.crt.
6. Renew: lego v5 has no separate 'renew' command — re-run the same lego run ... command (e.g. from cron); it is idempotent and renews the cert automatically once it's due, using the same logic as the initial run.
7. Official docs: https://go-acme.github.io/lego/usage/cli/ (redirects to /lego/obtain/), https://go-acme.github.io/lego/dns/, https://go-acme.github.io/lego/references/ref-flags/, https://go-acme.github.io/lego/migration/cli/