Thanks Juergen, but I don’t “use” anything, there is something scheduled to do it.
I’ve been running *nix boxes in the last 20 years so I know about scheduled task a bit and there is nothing I can think of that starts that task. I think it is started inside some daemon since there are no logins at that time, and scheduled tasks always have a login entry for the user running that.
I supposed some update to certbot added some daemon or hook, it was working since the update I made a couple of weeks ago.
Editing to list the service i found:
Tried disabling it, let’s see.
I understand some update installed that service