I'm told the you need to manually upload from to the synology interface the first time, but after that they will be in /usr/syno/etc/certificate/_archive/OpytNe (where OpytNe is a random string it generates for you).
Some more details;
I edited the certbot config file and added a post_hook = /path/to/script/file.sh entry
config/renewal/synology.localdomain.conf is what the file looks like
it's in INI format ... that post_hook entry goes under the [renewalparams] section
I setup a wildcard in https://github.com/technicalpickles/picklehome/issues/75 to use for the DSM. I have a few months before it expires, but would need to do something to renew it automatically and push it to the synology
Some more details;
cc https://github.com/technicalpickles/picklehome/issues/75