… except ensure the cron job runs reliably on a timescale of years…

(Not that I think cron is unreliable - I only recently stopped getting monitoring summary email from a cron job I set up in '99 or '00 on a server that'd been migrated at least 3 times while I still worked there, and who knows how many times after I left in '08, I stopped getting the mail in '14 or '15... But I've also had cron jobs silently die when OS updates break perl/python/shell scripts or permissions - looking at _you_ OS X...)

I personally think it being a cron job is a bad idea. I do my LE cert renewal in the web server itself, so the web server would have to crash for the LE cert renewal to not run.

LE send you a mail if you have a cert going to expire. Easy to spot if something went wrong in your cron tasks (not that you can totally rely on automated task of course, but it's another layer of security)

Before someone complains that LE is going to spam you with expiry notices: If you set up your process right (i.e. certbot cronjob with --keep-until-expiring), certs will be renewed early enough that the mail reminder never triggers unless there's an actual problem.

Yes (thank you for clarifying this point for others), the first mail is sent a month before expiration, and the certs are renewable after a month.

So with a weekly cron (for example) you should never get any mail from LE. That's why I meant. Thanks again.

It still seems wrong to do it that way. Plus, the TLS-SNI-01 challenge is just such a clean way of handling it, no need to have a special path handling or anything. Server up and running? Then my cert is being renewed, assuming LE isn't broken at least...