For renewals I keep a timer that runs certbot renew --dry-run in staging first, then the real renew plus nginx -t before reload. Most HTTP-01 failures I see are still a stale server_name or the challenge path proxied away from the ACME location.