My Apple Pay / Let's Encrypt fuckery is ongoing.

The dnalounge.com cert expires in 16 days and /etc/letsencrypt/renewal/dnalounge.com.conf says "renew_before_expiry = 40 days". So why is "certbot --dry-run renew" saying "Cert not due for renewal, but simulating renewal for dry run"?

Adding "-vvvv" spat out a bunch of XML that did not answer my question.

Previously, previously.