Google Cloud Load Balancer + Instance Group + SSL Certificates

My project consist of a main website where users can register an account. After registering they each get a website (subdomain of my own domain) where they have an e-commerce shop managed by a platform hosted on my main site (the one they registered with) Like this

example1.com -> main website (login, register etc)
example1.com/platform -> management platform
store1.example1.com -> User 1's store
store2.example1.com -> User 2's store

And in terms of hardware right now my setup is this: 1 VM instance in GCP with apache, a couple of virtual hosts setup with some wildcards that can map the domain requested to the apropriate folder.
I also generated a wildcard certificate on my main domain protecting all my customers stores with SSL.

Now, i wanted to prevent server overload over time so i though having a load balancer connected to an instance group of machines replicated from the one explained above would solve my problem, in theory it works but i have a problem:

Each user has the power to buy a domain name of his own and redirect it to my ip (LB or VM) so that their store would look something like this:

store1.com -> User 1's store
store2.com -> User 2's store

And, if they wanted they could "buy" a SSL certificate on my platform to protect their domain name. I can easily handle creation of SSL certificates on the fly through API's certbot and letsencrypt but, since my vm's would be running on a instance group, any certificate file that i save on the currently working VM would not be replicated to the others (if any) and could even be lost when the instance group decided it no longer needed that current VM. How could i arranje everything (LB, instance group, vm and/or apache) so that the load balancer would send traffic to multiple vm in my instance group but they could "share" in someway the certificates folder or even the whole disk..?

BTW persistent disk on VM's can only be mounted to multiple VM's if they are in read-only mode (not gonna work) and i also tried filestore but it cost 200 per month and that's a bit much just for this..

As @JohnHanley pointed out:

Manage the certificates on the LB-setup and remove certbot from the Webserver. There will be some overhead with Google domain-verification, but it is definitely worth a try.

Regarding LB-configuration and certificates:

• you can't change a configured certificate on a LB
• but you can add a new certificate (e.g. with an additional hostname) and add it to a existing LB and later remove the older certificate setup

There are some Terraform modules around that could support you, but of course this would create some learning and management effort as well.