TIL: You need to restart Nginx to have a replaced/renewed SSL cert to get served. Only real moment of confusion since starting @letsencrypt