nginx as the only thing holding a certificate

A certificate loaded by one process, and a reload that had to work for the renewal to take effect.

the chain of things that must all succeed:

  the ACME client renews         → a file changes
  the deploy hook runs           → nginx reloads
  nginx re-reads the file        → the new cert is
                                   served

any break serves the old certificate until it expires,
and only the third step is observable from outside.

which is why the check is an external one on the
served certificate, and why it is the only check that
has ever caught anything.

Three steps, of which the first two report success independently and neither implies the third. This is the same finding as 2024 stated more generally: a chain where each link reports its own success needs a check on the outcome, and the outcome here is what a client sees.