Apex hostnames are the usual DNS snag here: most providers reject a CNAME at the zone root, so the bare domain needs an A or AAAA record aimed at the VPS while www can be a CNAME to that same name. Lower the TTL on those records to a few minutes a day before cutover, otherwise a wrong target stays cached long after you fix it. Certbot's HTTP-01 challenge only completes when the Nginx server_name matches the exact hostname on the certificate request, including apex versus www and any extra names on the same cert. After issuance, curl -I on both names should show one 301 to the canonical host, the expected certificate, and no bounce back to plain HTTP. Leave port 80 reachable for that same server_name, because a later config that only redirects will make the next HTTP-01 renewal fail. If a proxy sits in front later, the public A record has to point at that proxy or the live certificate and the challenge path will disagree.