Certbot renewal for standalone certificates. Run a script instead of 'certbot renew -q', only.

certbot-renew.sh

#!/bin/sh
# Brady Shea - 06SEP2019
#
# Alternative certbot.service file for use on standalone.
# If you use the apache2.service (or another webserver) please adjust.
#
# This will be run as root from systemd.timer/service.
# Verify '/lib/systemd/system/certbot.service' calls this script.
#
test -x /usr/bin/certbot && \
systemctl stop nginx.service && \
sleep 10; \
/usr/bin/certbot -q renew && \
sleep 10; \
systemctl start nginx.service

certbot.service

[Unit]
Description=Certbot
Documentation=file:///usr/share/doc/python-certbot-doc/html/index.html
Documentation=https://letsencrypt.readthedocs.io/en/latest/
[Service]
Type=oneshot
ExecStart=/home/ubuntu/scripts/certbot-renew.sh
PrivateTmp=true

Steps:

1. Add the ".sh" script to your system. Neither location nor filename is important.
2. Edit the /lib/systemd/system/certbot.service (see revision of .service file above for the only change/difference)
3. Set permissions - just make sure it's executable by root.

Here is mine:
sudo chmod 760 certbot-renew.sh && sudo chown root:ubuntu certbot-renew.sh
Then:
ls -la ~/scripts/certbot-renew.sh
Should show:
-rwxrw---- 1 root ubuntu 442 Sep 6 22:59 /home/ubuntu/scripts/certbot-renew.sh

Permissions set. Good to go..