Expiry outages usually mean renewal quietly stopped
Let's Encrypt certificates last 90 days, so renewal has to be automatic. Move a server or change a firewall rule and the renewal step can start failing without anyone noticing — until the day it expires and the site goes down. Fewer than 30 days left with no recent renewal is the moment to look.
Coverage (SAN) matters too
A certificate lists exactly which hostnames it vouches for. Forget www, or add a subdomain without reissuing, and only visitors arriving at that address see the warning.
Turn off legacy TLS
TLS 1.0 and 1.1 have known weaknesses and are flagged in every security review. Every current browser supports 1.2 or above, so disabling them costs you nothing in practice.