After certbot --nginx, two things still bite me: keep port 80 reachable for http-01 renewals even with a blanket HTTPS redirect, and run certbot renew --dry-run once before you walk away. Also wire ssl_stapling on with ssl_trusted_certificate pointing at the fullchain so some clients stop seeing a stale intermediate right after renew.