A renewal that has never run is one that will fail in sixty days

A timer that has been scheduled and has never actually renewed anything is untested code with a deadline, and the first sign of trouble is a browser warning.

$ certbot renew --dry-run
Simulating renewal of an existing certificate for example.com
Congratulations, all simulated renewals succeeded

$ certbot renew --dry-run --deploy-hook 'systemctl reload nginx'

$ journalctl -u certbot-renew --since '30 days ago' | grep -c 'Congratulations'
60

The dry run uses the staging environment, so it exercises the challenge, the DNS or HTTP proof and the hook without touching the production rate limit — which matters, because five duplicate certificates a week is easy to hit while debugging. The deploy hook is the half that fails silently in real life: the certificate renews on disk and nginx keeps serving the old one. Running the dry run monthly from cron and alerting on a non-zero exit is ten minutes of work.