A Debian-based Compute Engine VM utilizes Certbot version 2.9.0 to obtain SSL certificates. The Certbot version has since been updated to 2.10.0. When I initially obtained the certificates, the renewal process was automatically set up using a systemd timer running as root, which matches the configuration in my console.
However, a recurring issue has emerged: when executing the certbot renew command either directly from the console or through the systemd timer's automatic renewal, I receive 403 errors for all certificates obtained in February. This indicates that the error isn't limited to one particular method, affecting both automated and manual renewals.
To investigate further, I requested a new certificate (certtest.accept.spend.cloud) on Wednesday using the same service account. It worked fine and didn't encounter any 403 errors, suggesting that the issue is specific to the Certbot API call made during the DNS record update for older certificates. Renewals for newly issued certificates don't encounter this problem.