certificate renewal (90-day lifetime)

A Let's Encrypt certificate is valid for ninety days, so issuing one opens a recurring job rather than finishing a task. certbot installs a systemd timer that renews once fewer than thirty days remain — systemctl list-timers | grep certbot shows it, and sudo certbot renew --dry-run proves it against the staging service. Untested, it is the whole difference between a working site and one that breaks three months later, on a day when nothing changed on the server and the journal has nothing to report. The second trap is the reload. Nginx reads the certificate at startup and holds it in memory, so a renewed file changes nothing until nginx reloads — certbot --nginx arranges that, a certonly issuance does not unless you pass --deploy-hook. sudo certbot certificates reads the files; openssl s_client -connect example.com:443 -servername example.com reads what nginx actually serves. When the two disagree, reload.