This is a rather drastic measure but sure. Judging by the certificate history for your domain, you were getting renewals every 2 month like a clockwork, which is good (with one instance of renewing after a month 2023-02-18→2023-03-11, which is peculiar). Looks like you were lucky to have your server rebooted within a month after renewal?
It's best to have your webserver reloaded automatically after renewal. What does /etc/letsencrypt/renewal/frankhaefele.spdns.eu.conf look like?
Renewal config looks good at least. I'll let other volunteers to advise on how to “non-destructively” add a deploy hook to the existing lineage, I don't know how off the top of my head. Or you could look into deploy-hooks yourself.
Yes, your Certbot renewal config does not reload nginx. So, you must have had some scheduled reload or restart in the 30 days from when a cert was renewed but before it expired.
You should be able to add an auto-reload by running this once
where "nginx reload" is the command you use to reload nginx (a restart is not required)
I am not certain what Debian 11 uses but maybe like service nginx reload or its systemctl equivalent systemctl reload nginx
WARNING: This is one of the rare times that --force-renew is needed. We want to force renew early so to update the renewal config file. Only do the force once.
Changing the .conf file manually is not recommended. The value is not the same in the conf file as on the command line. Please use the command line. You could update your Certbot to the snap version and then use the reconfigure command like @9peppe suggested. See https://certbot.eff.org
You can omit sudo in the --deploy-hook because renew should already be running within a root user.
# /etc/cron.d/certbot: crontab entries for the certbot package
#
# Upstream recommends attempting renewal twice a day
#
# Eventually, this will be an opportunity to validate certificates
# haven't been revoked, etc. Renewal will only occur if expiration
# is within 30 days.
#
# Important Note! This cronjob will NOT be executed if you are
# running systemd as your init system. If you are running systemd,
# the cronjob.timer function takes precedence over this cronjob. For
# more details, see the systemd.timer manpage, or use systemctl show
# certbot.timer.
SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
0 */12 * * * root test -x /usr/bin/certbot -a \! -d /run/systemd/system && perl -e 'sleep int(rand(43200))' && certbot -q renew