Certificate expires soon: certbot auto-renewal and checks

What's wrong

A Let's Encrypt certificate lives 90 days. If fewer than 30 days are left, auto-renewal is probably broken: certbot renews 30 days before expiry.

Checking auto-renewal

certbot renew --dry-run               # test renewal
systemctl list-timers | grep certbot  # is there a timer (or cron)

Common causes:

• webroot: nginx doesn't serve /.well-known/acme-challenge/ (HTTPS redirect to another domain, return 444, port 80 closed);
• DNS challenge: the DNS provider API token expired;
• the certificate renewed but nginx never reloaded it — no deploy hook.

How to fix

server {
  listen 80;
  server_name example.com;
  location ^~ /.well-known/acme-challenge/ { root /var/www/certbot; }
  location / { return 301 https://$host$request_uri; }
}

certbot renew --deploy-hook "systemctl reload nginx"

Check expiry and chain after renewal with SSL Checker.