On Ubuntu I keep Certbot renew on a timer and always run nginx -t before reload in the deploy-hook. HTTP-01 failures are usually a missing server_name or the challenge path getting proxied away from nginx.