After setup:

1. Nginx serves HTTPS correctly.
2. Certificate renewal runs automatically.

Typical workflow:

• install certbot and nginx plugin
• request certificate
• test auto-renew (certbot renew --dry-run)