And this is the reason why Debian (and its derivs) ship a cron and systemd timer for you with certbot. You shouldn't have to think about or worry about this stuff. Certbot handles it for you.
I tried many things, and can verify the cron task renews when I test it, but months later it always fails.
I also set up traefik with auto renewal so it's a setup and forget thing now.
It does your auto renews in the background.