LetsEncrypt issues for 3 months by default and then tries to renew after 2 months.

So if renewal fails you should have ~30 days to fix it.

But this does work best if your tools try the 2-month renewal. (I'm looking at you, wpengine!)