>By mandating a 90-day expiry, LetsEncrypt forced people to automate the process -- and everyone is on the same page. Ironically, I had the opposite problem. I

>By mandating a 90-day expiry, LetsEncrypt forced people to automate the process -- and everyone is on the same page. Ironically, I had the opposite problem. I used to be on top of things like cert expirations, but now I just let certbot do everything. The problem (at least in my case) was that even though certbot updated the cert on time, it doesn't restart / reload nginx so that it picks up the new cert. My site was up for the full ~30 days between the renewal and the expiration of the old cert. So my site went down because of letsencrypt's cert renewal policy. (I now have a script set up that reload's nginx's configuration whenever the certificate is updated.)