[Unit]
Description=Let's Encrypt renewal

[Service]
Type=oneshot
ExecStart=/usr/bin/certbot renew --rsa-key-size 4096
ExecStartPost=/bin/systemctl reload nginx.service