certbot renew: Failed to renew certificate (all renewals failed)

What the message looks like

Failed to renew certificate cloud.example.com with error: Some challenges have failed.
All renewals failed. The following certificates could not be renewed:
  /etc/letsencrypt/live/cloud.example.com/fullchain.pem (failure)

Common causes

• The renewal file uses authenticator = standalone, but nginx or Apache already holds port 80.
• The webroot path or the web server changed, so the challenge file is no longer reachable on the domain.
• The renewal timer or cron job is not running, so renewal is never attempted.
• A pre, post or deploy hook fails, for example the reload of a service that no longer exists.
• DNS, firewall or an IPv6 record no longer reaches this server for the domain.

Check

1. Which certificates exist and when do they expire?
   sudo certbot certificatesCopy
2. Test the full renewal without changing anything
   sudo certbot renew --dry-runCopy
3. Is a renewal timer scheduled?
   systemctl list-timers | grep -i certbotCopy
4. What does the log say?
   sudo tail -n 40 /var/log/letsencrypt/letsencrypt.logCopy

Fix

• Run sudo certbot renew --dry-run and read the first error. It uses the staging server, so it is safe and does not use up the production limits.
• If it says the port is in use, change the method: sudo certbot certonly --nginx --cert-name cloud.example.com -d cloud.example.com (or --apache or --webroot -w /var/www/html). This rewrites the renewal file.
• Enable the timer: sudo systemctl enable --now certbot.timer. With the snap package it is snap.certbot.renew.timer.
• Fix or remove failing hooks in /etc/letsencrypt/renewal-hooks/, and use a deploy hook such as systemctl reload nginx to load the new certificate.
• Run the dry run again until it ends with success, then check the new expiry with sudo certbot certificates.

FAQ

Is --force-renewal the answer?

Rarely. It does not fix the cause and each forced issue counts against the rate limits. Fix the failing step found by the dry run first.

The renewal worked but the browser still shows the old certificate. Why?

The web server loads the certificate only when it starts or reloads. Add a deploy hook that reloads it, or reload by hand once.