Renewals failing after upgrade to debian 11

[MikeMcQ]

@ChristianFarley

if ($host = www.setpad.ca) {
    return 301 https://$host$request_uri;
} # managed by Certbot


if ($host = setpad.ca) {
    return 301 https://$host$request_uri;
} # managed by Certbot

That looks like dormant code. The redirect on port 80 (HTTP) goes to some domain name that is not yours. So, I am extremely confident it is at your WP Engine service.

In any case, you don't have to delete those lines if you don't want. Yes, go ahead with:

rm /etc/letsencrypt/renewal/setpad.ca.conf
certbot delete --cert-name setpad.ca-0001
certbot delete --cert-name setpad.ca-0002

Note: We can make a new cert for setpad that actually works if we need to