When I set up this Mastodon instance a couple months ago I extended my existing kylerank.in cert and added the new subdomain as a SAN. Everything worked fine at the time, but apparently that made certbot change the Nginx config it uses for the .well-known directory, causing automatic renewal to fail.
I discovered this after the cert expired yesterday, but fortunately it was simple to fix, once the problem was clear. Something to watch out for if you add SANs to an existing cert.
@kyle check out Caddy server (as a replacement for nginx). I've recently made similar changes in my self-hosted services, but Caddy handled it invisibly (and successfully of course). https://caddyserver.com/
