[spatz]

That would work for one file but there's no way to atomically rename two.

[rubatuga]

You should only need to update the certificate not the private key

[regecks]

I suppose you could do it if you placed them in a directory, and renamed that. But I don't think that's what Certbot does, I think it works by changing file symlinks individually.

[tinus_hn]

The actual problem is the other way around: you can’t open two files atomically.

[scurvy]

There's a format that stores key and cert in the same file. Name escapes me now and I'm not sure if nginx supports it.

Edit: it does. Just use that instead of messing with separate files