Oops, came back to my cert having expired because I forgot to add "reload nginx" to the list of tasks the automated cert renewal did. Should be all good now.