Clear setup path. One renewal footgun I still hit on VPS boxes: after Certbot adds the 443 block and a blanket return 301 on port 80, http-01 renewals fail later if something else (panel rewrite, extra server block, or a firewall rule) stops serving /.well-known/acme-challenge/. I leave a dedicated location for the challenge on 80 before the redirect, then dry-run renew after any nginx change.

Also worth verifying the certificate paths nginx actually loads — fullchain.pem versus cert.pem — especially when clients complain about incomplete chain while openssl s_client on the box looks fine with the wrong file. After reload I check that OCSP stapling is on and that proxy_set_header X-Forwarded-Proto $scheme is present so the app does not redirect-loop between http and https. Small thing, but nginx -t && reload beats restart when you already have active upstream connections.