certbot renew checks every certificate it manages and does nothing for those with more than thirty days left. Running it often is therefore free, and running it rarely is how a certificate expires on a weekend.
# /etc/cron.d/certbot
0 3,15 * * * root certbot renew --quiet --deploy-hook "systemctl reload nginx"Twice a day at odd minutes is the recommendation, and the odd minutes matter — a fleet all renewing at midnight is a thundering herd against a free service. --deploy-hook only runs when something was actually renewed, unlike --post-hook which runs every time; reloading nginx twice a day for no reason is harmless but obscures the log. Test the whole thing with --dry-run before trusting it, because the failure is silent for sixty days.