Nice write-up. One gotcha after Certbot finishes: nginx reloads fine but some clients still see a stale chain until OCSP stapling is set. I usually add ssl_stapling on; ssl_stapling_verify on; and point ssl_trusted_certificate at the fullchain, then reload. Also keep port 80 reachable for renewals even with a blanket 443 redirect—http-01 still needs that path, and a quick certbot renew --dry-run catches surprises before the cert actually expires.