When renewing, certbot places all the new files (certificate, private key et cetera) as totally new files in /archive/[domainforcert]. Then it updates the symlinks in /live/ to those new files in /archive/.
When renewing, certbot places all the new files (certificate, private key et cetera) as totally new files in /archive/[domainforcert]. Then it updates the symlinks in /live/ to those new files in /archive/.