Good 2026 checklist. After the cert is in place I always confirm: (1) only modern TLS protocols/ciphers, (2) HSTS only once every subdomain you care about is already on HTTPS, (3) OCSP stapling with ssl_trusted_certificate pointing at the full chain, and (4) certbot renew --dry-run still works with port 80 reachable for http-01. The quiet failures are usually a blanket 443 redirect that breaks renewal, or a missing intermediate that some clients reject.