Reliable Let's Encrypt renewals on RHEL / Rocky

A certificate can only be renewed in its last 30 days. A cron job that tries once a month can miss that window after a single failure, and the certificate expires.

Use the packaged timer

The EPEL certbot package ships a systemd timer that runs twice a day:

sudo systemctl enable --now certbot-renew.timer
systemctl list-timers certbot-renew.timer

Remove any old monthly certbot cron entries.

Reload the web server after renewal

A renewed certificate isn't used until the web server reloads. Add a deploy hook:

sudo install -m 755 /dev/stdin /etc/letsencrypt/renewal-hooks/deploy/reload-web.sh <<'H'
#!/bin/sh
systemctl reload httpd 2>/dev/null || systemctl reload nginx
H

Or, for the packaged timer, set it in /etc/sysconfig/certbot:

DEPLOY_HOOK="--deploy-hook 'systemctl reload httpd'"

If you must use cron

17 3,15 * * * root /usr/bin/certbot renew -q --deploy-hook "systemctl reload httpd"

Test

sudo certbot renew --dry-run