Old ee v3 has problems, quite often, regarding ssl renewals. For example: the cert might be renewed but the nginx didn't load it, or it didn't renew. I am not sure what was my scenario, but I renewed it manually. Another solution I found on ee forum is to reload the nginx with the command.
Maybe you can adjust current renewal cron to reload nginx too?
