Check the identity you use
A certificate must cover the hostname the client verifies. The connection address, SNI and service's backend address can be different values; document each explicitly. A certificate for one virtual host is not evidence that another host on the same IP is correctly configured. Test the public hostname with certificate verification enabled.
Keep private keys private
When two services share a certificate, avoid granting the second service access to the certificate manager's entire storage tree. A narrowly scoped root task can validate the certificate and matching key, then publish a dedicated copy readable only by the intended service group. Build a complete generation before switching the reference so readers never observe half of a renewed pair.
Test renewal without exhausting issuance
A timer being enabled is not sufficient. Exercise the copy-and-load path with an existing valid pair and verify the consuming service can read it under its actual account and sandbox. Check how a changed certificate reaches an already running process. Keep the previous generation and test recovery from a validation failure. Routine renewal should not require changing the website's established ACME process.
At the terminal
openssl x509 -in certificate.pem -noout -subject -issuer -dates
openssl x509 -in certificate.pem -noout -checkhost example.com
openssl x509 -in certificate.pem -noout -checkend 86400