Have to run this in check mode too so we can get the variable output now.

roles/letsencrypt/tasks/main.yml

@@ -3,6 +3,7 @@
   command: certbot certonly --keep -n --webroot --webroot-path /var/www/html/ -d {{','.join([site_name] + server_aliases)}}
   run_once: true
   register: certbot_output
+  check_node: no
   changed_when: "not ('not yet due for renewal' in certbot_output.stderr)"
   tags:
   - letsencrypt