Linux – Certbot LetsEncrypt Sending Scary Email, Not Sure If Auto-Renewal Is Working

I am running a linux server for a nodejs express app at katefromhrbot.com, and I used the certbot guide for Nginx and Ubuntu 18.04 LTS to give it the secure https domain support. It is working now, but I recently received a rather worrying email which had given me a swarm of butterflies inside of my stomach organ, as the email stated that my certificate would terminate and expire in the near future unless I took action! I was confused by this because the last step of certbot says, "You will not need to run Certbot again, unless you change your configuration. You can test automatic renewal for your certificates by running this command". I had run the renewal dry run command back when I initially set it up so I'm confused why I need to do anything for the renewal in the first place. 🤔

Output from lsb_release -a:

No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 18.04.2 LTS
Release:    18.04
Codename:   bionic

Here is the email from "expiry@letsencrypt.org":

Hello,

Your certificate (or certificates) for the names listed below will
expire in 20 days (on 08 Dec 19 17:46 +0000). Please make sure to
renew your certificate before then, or visitors to your website will
encounter errors.

We recommend renewing certificates automatically when they have a
third of their total lifetime left. For Let's Encrypt's current 90-day
certificates, that means renewing 30 days before expiration. See
https://letsencrypt.org/docs/integration-guide/ for details.

katefromhrbot.com

For any questions or support, please visit
https://community.letsencrypt.org/. Unfortunately, we can't provide
support by email.

For details about when we send these emails, please visit
https://letsencrypt.org/docs/expiration-emails/. In particular, note
that this reminder email is still sent if you've obtained a slightly
different certificate by adding or removing names. If you've replaced
this certificate with a newer one that covers more or fewer names than
the list above, you may be able to ignore this message.

If you are receiving this email in error, unsubscribe at
…

Regards, The Let's Encrypt Team

The odd thing is that when I log into my server and try to run sudo certbot renew then it says this:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/katefromhrbot.com.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Cert not yet due for renewal

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

The following certs are not due for renewal yet:
  /etc/letsencrypt/live/katefromhrbot.com/fullchain.pem expires on 2020-02-16 (skipped)
No renewals were attempted.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

So, did the automatic renewal work? If so, it would probably be better for the let's encrypt both do send an email when that renewal goes through successfully rather than (or at least in addition to) the one that tells you to panic because your certificate is about to expire.

Also, it's unclear to me exactly when the renewal is allowed to take place, and when it actually takes place when the automated renewal happens.

So, I have these questions:

• Is there is any way to see these 2 dates (the earliest time you can renew and when the automatic renewal will renew)?
• Should be worried that my certificate will really expire on December 16 without being renewed (and then again on 2020-02-16) assuming I do nothing and leave it up to autorenewal?
• What emails should I be expecting to get and should I be worried about the emails saying my certificate will expire soon? Is that normal and can I basically ignore them? Is there any way to set config on which things trigger emails (ie. successful auto-renewal)?
• Also, When I run sudo certbot renew --dry-run it gives me a strange error about a request message being malformed, so I am wondering if I should be worried about that as well.

Saving debug log to /var/log/letsencrypt/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/katefromhrbot.com.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Cert not due for renewal, but simulating renewal for dry run
Plugins selected: Authenticator nginx, Installer nginx
Renewing an existing certificate
Attempting to renew cert (katefromhrbot.com) from /etc/letsencrypt/renewal/katefromhrbot.com.conf produced an unexpected error: urn:ietf:params:acme:error:malformed :: The request message was malformed :: Method not allowed. Skipping.
All renewal attempts failed. The following certs could not be renewed:
  /etc/letsencrypt/live/katefromhrbot.com/fullchain.pem (failure)

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
** DRY RUN: simulating 'certbot renew' close to cert expiry
**          (The test certificates below have not been saved.)

All renewal attempts failed. The following certs could not be renewed:
  /etc/letsencrypt/live/katefromhrbot.com/fullchain.pem (failure)
** DRY RUN: simulating 'certbot renew' close to cert expiry
**          (The test certificates above have not been saved.)

Thanks!