That you have to remember to update your certificates is the problem here.

Automation solves these problems. Don't be the computer's slave--tell it what to do.

I'll spend more time trying to automate that, than renewing it for a 20 years manually.

1) That's just plainly and self-evidently silly. `0 0 * * 0 certbot --nginx`. Season to taste. (There are more involved options out there--but you bought into them by making other choices ahead of time, and that's a learning experience for you to better understand your tradeoffs in the future.)

2) 20 years' expiration is a security risk that should not be taken. Letting you do that would be a bad idea not just for you--you can make stupid decisions on your own--but for anyone who connects to you, and you aren't entitled to do that.

I don't understand why someone who is theoretically a programmer would be so odd about this.

Obligatory: https://xkcd.com/1205/