I set it up ages ago, maybe before they even had a script. My setup is dead simple: A crontab that runs monthly:

    0 2 1 * * /usr/local/bin/letsencrypt-renew

And the script:

    #!/bin/sh
    certbot renew
    service lighttpd restart
    service exim4 restart
    service dovecot restart

... and so on for all my services

That's it. It should be bulletproof, but every few renewals I find that one of my processes never picked up the new certificates and manually re-running the script fixes it. Shrug-emoji.

Yes, same for me. Every few months some kind internet denizen points out to me that my certificate has lapsed, running it manually usually fixes it. LE software is pretty low quality, I've had multiple issues over the years some of which culminated in entire systems being overwritten by LE's broken python environment code.

If it's happening regularly wouldn't it make sense to add monitoring for it? E.g. my daily SSL renew check sanity-checks the validity of the certificates actually used by the affected services using openssl s_client after each run.

I don't know how old "letsencrypt-renew" is and what it does. But you run "modern" acme clients daily. The actual renewal process starts with 30 days left. So if something doesn't work it retries at least 29 times.

I haven't touched my OpenBSD (HTTP-01) acme-client in five years: acme-client -v website && rcctl reload httpd

My (DNS-01) LEGO client sometimes has DNS problems. But as I said, it will retry daily and work eventually.

> I don't know how old "letsencrypt-renew" is and what it does.

It's the five lines below "the script:"

I'm sorry mister perfect. I officiously meant "certbot".

I wasn't making fun of you. It wasn't obvious that's what you meant at all, because you said you didn't know "what it does". I'm sure you know what certbot does, so I thought you misinterpreted the post.