A renewal that logs success while browsers still show the old dates usually means a different nginx was reloaded than the one holding port 443, or the files on disk are not the ones ssl_certificate names. Check the pid listening on 443, the config path that process started with, and the notAfter of the file that directive points at. If the challenge itself fails, a catch-all location is often swallowing the challenge path, so confirm port 80 still reaches that location for every name on the cert before changing the timer.