A certificate renewal that failed silently for sixty days

Automated renewal that had been failing since a path changed, discovered with nine days to spare by somebody looking for something else.

# the renewal timer was fine. the deploy hook was not.
$ systemctl status certbot.timer
  Active: active (waiting)
$ journalctl -u certbot | grep -c 'Hook command .* returned error'
60

# and the check that should have existed all along
$ echo | openssl s_client -connect example.com:443 2>/dev/null 
  | openssl x509 -noout -enddate

Monitoring the renewal job tells you whether the job ran; monitoring the certificate tells you whether it worked, and only the second one is the thing that matters. An external check on the served certificate’s expiry, alerting at 21 days, is four lines and does not depend on any of the machinery that is failing.