Hello, If I understand well, the certbot in bookworm LTS is version 2, which does not support ARI (dynamic windows to resist to mass revocations). Even trixie certbot is not 4.1+.
Even on bookworm, as certbot is started twice a day, and /etc/letsencrypt/renewal/XXX.ch.conf:# renew_before_expiry = 30 days it should work no problem in 2027 (64 days certificate lifetime, reissuing recommended at 2/3 of certificate life) or even 2028 (45 days, 2/3 is just 30 days). Do you agree with this analysis? Have a nice day/evening. Reference: https://letsencrypt.org/2025/12/02/from-90-to-45
