Notes
These entries are intentionally direct. They focus on checks that are easy to reproduce from a terminal and simple enough to use during a late maintenance window.
For small static sites, webroot validation keeps certificate issuance separate from the web server configuration. The challenge directory can be tested with a temporary text file before requesting a certificate, which makes failures easier to diagnose.
Configuration changes should be staged as small files, checked with the service's own syntax test, and reloaded only after the expected listener and certificate paths are clear. A reload should not be used as a debugging shortcut.
A complete static site can be restored by copying a directory and one server block. Keeping pages free of external dependencies avoids a second failure mode when a third-party asset host is slow or unavailable.
Low TTL values help during a planned migration, but public resolvers can still cache older answers for a short time. Verification should include at least one local resolver and one public resolver before the final service change.
Routine logs are most useful when they answer simple questions: which host was requested, which status was returned, how long the request took, and whether the upstream was involved. Anything more can usually wait for a focused incident review.