Plan renewal in advance
Monitor the expiry date of the certificate actually served and automate renewal. Lifetimes depend on the certificate authority and profile and can change. Avoid assuming a fixed one-year lifetime. After renewal, verify that the web server serves the new certificate and required intermediate certificates.
CloudPanel and managed hosting
In CloudPanel, certificates are managed in the site's SSL/TLS area. For Let's Encrypt, domain names and validation must match the server configuration. Use the existing panel management and check its renewal process rather than installing a second certificate client in parallel. For other hosting panels, follow their documented workflow.
Certbot on self-managed servers
When Certbot is already responsible for certificates, certbot renew --dry-run tests renewal. certbot renew handles certificates that are due. Installation and web-server integration depend on the system. Check existing timers or scheduled jobs before adding more. Automated DNS validation needs appropriate, carefully protected credentials.
Resolve errors and verify deployment
Check DNS, validation reachability, CAA records, client logs and system time. An appropriate reload may be needed after installation. Do not switch to unencrypted HTTP or disable HSTS to repair an expired certificate. Afterwards, verify every required hostname and, where applicable, the CDN and origin server separately.