To get a wildcard SSL certificate from LetsEncrypt you need to run certbot version 0.22 or later according to https://community.letsencrypt.org/t/acme-v2-production-environment-wildcards/55578
I've installed certbot from apt using
sudo apt-get install certbot
However, that reports:
certbot is already the newest version (0.17.0-2).
How can I upgrade certbot to a version that supports wildcard certificates?