Certbot and nginx only stay healthy when server_name, the HTTP-01 (or TLS-ALPN) challenge path, and the live TLS server block agree on the same hostname. Drift between www and bare, or a challenge location that never hits the issuing vhost, is what makes renew look random while the site still serves an old cert.
I terminate TLS at nginx, set Host and X-Forwarded-Proto for any proxied app, and verify after each renew with a HEAD to the public name checking both the certificate SAN and any redirect Location. Keep port 80 open for the challenge (or use DNS-01 if you must close it), reload only after the new fullchain is on disk, and watch renew timers separately from deploy reloads so a release never races a cert swap. If browsers show NET::ERR_CERT_COMMON_NAME_INVALID after a domain add, the missing name is almost always in the cert — not in proxy_pass.
CDN Edge Ops
Certbot and nginx only stay healthy when server_name, the HTTP-01 (or TLS-ALPN) challenge path, and the live TLS server block agree on the same hostname. Drift between www and bare, or a challenge location that never hits the issuing vhost, is what makes renew look random while the site still serves an old cert.
I terminate TLS at nginx, set Host and X-Forwarded-Proto for any proxied app, and verify after each renew with a HEAD to the public name checking both the certificate SAN and any redirect Location. Keep port 80 open for the challenge (or use DNS-01 if you must close it), reload only after the new fullchain is on disk, and watch renew timers separately from deploy reloads so a release never races a cert swap. If browsers show NET::ERR_CERT_COMMON_NAME_INVALID after a domain add, the missing name is almost always in the cert — not in proxy_pass.