sudo certbot renew --standalone --pre-hook 'systemctl stop nginx' --post-hook 'systemctl start nginx'

For renewals when nginx holds port 80: --standalone makes certbot run its own temporary web server on port 80 to answer the challenge, so nginx must be stopped first (--pre-hook) and started again after (--post-hook). The pre/post hooks bracket the whole run. Expect a brief downtime during the swap.