I think you are overcomplicating the process.
A cron job that runs immediately after renewal attempts would reload/restart the httpd service way too often.
Certs last 90 days.
They only need to be renewed after 60 days [default].
The renewal process runs and first checks to see if any certs need to be renewed.
Most of the times, there is nothing to renew.
Either:
- use a
deploy-hookto reload/restart the httpd service [which is only triggered when a cert is actually renewed] - schedule the reload/restart without any regard to the cert state [like once a week (every week) during off hours]
The cert should renew 30 days ahead of expiry - that should cover four reloads/restarts.