After issuance I always pin ssl_certificate paths in the server block and run nginx -t before any reload. For renewals, keep HTTP-01 reachable on every server_name covered by that cert, or switch that name to DNS-01 once instead of fighting challenge routing.