Set up and verify unattended automatic renewal of Certbot-managed certificates: confirm the pre-installed systemd timer or cron job, validate it with a dry run, and reload the web server only after a real renewal using --deploy-hook.

Documented steps

1. Check whether your install already has a scheduled renewal job before adding your own: on Linux/BSD run 'systemctl list-timers' (systemd) or inspect /etc/crontab and /etc/cron.*/* for a 'certbot renew' entry. Most Certbot installs (notably the Snap) come with this preconfigured.
2. If none exists, follow the instructions for your system at https://certbot.eff.org/instructions, or manually add a cron entry: SLEEPTIME=$(awk 'BEGIN{srand(); print int(rand()*(3600+1))}'); echo "0 0,12 * * * root sleep $SLEEPTIME && certbot renew -q" | sudo tee -a /etc/crontab > /dev/null
3. Test the whole renewal pipeline without touching real certificates: sudo certbot renew --dry-run (this exercises the same plugin/options used originally, against the staging server unless a custom --server is set).
4. If a plugin like standalone needs the web server stopped to bind port 80, add hooks so it restarts automatically: certbot renew --pre-hook "service nginx stop" --post-hook "service nginx start"
5. To reload/restart your server ONLY when a certificate actually gets renewed (not on every no-op run), use a deploy hook: sudo certbot renew --deploy-hook /path/to/deploy-hook-script (e.g. a script running 'systemctl reload nginx').
6. Alternatively, drop an executable script directly into /etc/letsencrypt/renewal-hooks/deploy/ (also /pre and /post exist) — Certbot runs everything found there in alphabetical order automatically, with no extra flags needed.
7. Confirm the exit status contract: 'certbot renew' exits 1 only if a renewal attempt actually failed, and 0 if nothing needed renewing — so a custom script must use --deploy-hook (not just the process exit code) to detect 'did a renewal happen'.
8. Official docs: https://eff-certbot.readthedocs.io/en/stable/using.html