Three usual reasons certbot renewal fails

Renewal starts thirty days before expiry, so an expiry warning means it has been failing for a while.

Run certbot renew --dry-run and read the output. Three usual causes.

Could not bind TCP port 80 — something else holds it, often another nginx or a stuck certbot. ss -lntp | grep :80.

Invalid response ... 404 — wrong webroot path, or nginx redirecting /.well-known/ to https.

DNS problem: NXDOMAIN — the name resolves elsewhere or the A record was removed, common right after moving hosts.

Fix it, then require a passing dry run. Do not wait for the real expiry to find out.