they're only for publicly accessible IP addresses, so they'd work the same as regular letsencrypt certs - get a new one when the old one expires.