The certificate that renewed itself and nobody verified

A renewal job that had been running successfully for two years, and a certificate that had been served from a stale copy for the last three months.

# the renewal was fine
$ systemctl status certbot.timer
  Active: active (waiting)
$ certbot certificates | grep 'Expiry Date'
  Expiry Date: 2024-04-11 (VALID: 78 days)

# the served certificate was not
$ echo | openssl s_client -connect example.com:443 2>/dev/null 
  | openssl x509 -noout -enddate
notAfter=Feb  8 09:41:02 2024 GMT

# nginx had not been reloaded since October.

Monitoring the renewal answers whether the job ran and monitoring the file answers whether it was written; only checking what is actually served answers the question. The deploy hook that reloads nginx had been silently failing on a permission change, and the renewal reported success because renewal had succeeded.