The issue was with certbot stopping apache for certs renewal, failing, and not restarting apache afterwards:
mars 13 12:02:15 kawa systemd[1]: Stopping The Apache HTTP Server... mars 13 12:02:15 kawa systemd[1]: Stopped The Apache HTTP Server. mars 13 12:02:26 kawa certbot[6014]: Attempting to renew cert from /etc/letsencrypt/renewal/awak.mobi.conf produced an unexpected error: Failed authorization procedure. awak.mobi (tls-sni-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Incorrect validation certificate for tls-sni-01 challenge. Requested 50a921b19347a4333a7d292d565adb89.a85575dc3cec8fca7c1c5f2350711608.acme.invalid from 78.207.29.31:443. Received 2 certificate(s), first certificate had names "awak.mobi". Skipping. mars 13 12:02:26 kawa certbot[6014]: All renewal attempts failed. The following certs could not be renewed: mars 13 12:02:26 kawa certbot[6014]: /etc/letsencrypt/live/awak.mobi/fullchain.pem (failure) mars 13 12:02:26 kawa certbot[6014]: 1 renew failure(s), 0 parse failure(s) mars 13 12:02:26 kawa systemd[1]: certbot.service: Main process exited, code=exited, status=1/FAILURE mars 13 12:02:26 kawa systemd[1]: Failed to start Certbot. mars 13 12:02:26 kawa systemd[1]: certbot.timer: Adding 15min 58.754102s random time. mars 13 12:02:26 kawa systemd[1]: certbot.service: Unit entered failed state. mars 13 12:02:26 kawa systemd[1]: certbot.timer: Adding 59min 29.268333s random time. mars 13 12:02:26 kawa systemd[1]: certbot.service: Failed with result 'exit-code'. Sorry for the noise. Please close bug. Regards, Xav