fix: replace staging certificate on production switch

docs/deployment.md

@@ -44,8 +44,10 @@ caller and it overwrites `X-Forwarded-*` headers.
 For direct TLS, public DNS and inbound ports 80/443 must reach NGINX. Start with
 `LETSENCRYPT_STAGING=1` and set `WP_URL` to the final HTTPS URL. Application HTTP
 returns 503 until a certificate exists, then redirects to HTTPS. Switch to the
-production CA only after validating DNS and firewall behavior, removing only the
-staging certificate directory when necessary.
+production CA only after validating DNS and firewall behavior. When
+`LETSENCRYPT_STAGING` changes from `1` to `0`, recreate the Certbot container; it
+removes an existing staging certificate for the configured domain before requesting the
+production certificate.
 
 ## State and rollback
 

docs/runbook.md

@@ -35,6 +35,21 @@ When Let's Encrypt is enabled, the proxy intentionally returns 503 for normal
 application paths until a certificate exists. ACME challenge paths and proxy health
 paths must still work in that pending state, otherwise Certbot will never start.
 
+## Staging certificate remains after switching to production
+
+Certbot does not replace a still-valid staging certificate just because
+`LETSENCRYPT_STAGING` changed. Recreate the Certbot container so it reads the updated
+environment:
+
+```bash
+docker compose up -d --force-recreate certbot
+docker compose up -d proxy
+```
+
+The entrypoint removes an existing staging certificate for `LETSENCRYPT_DOMAIN` before
+requesting the production certificate. If issuance fails, inspect `docker compose logs
+certbot proxy`, verify DNS and port 80, and avoid repeated production-CA retries.
+
 ## Bootstrap writes to the wrong data volume
 
 Do not combine the test override with production bootstrap commands. This command writes