So once in a while I receive an email about apache being unreachable. I mean it actively rejects connections (ERR_CONNECTION_REFUSED for Chrome).
systemctl status apache2
● apache2.service - The Apache HTTP Server
Loaded: loaded (/lib/systemd/system/apache2.service; enabled; vendor preset: enabled)
Active: inactive (dead) since Tue 2020-06-09 14:36:58 CEST; 8min ago
Process: 2533 ExecStop=/usr/sbin/apachectl stop (code=exited, status=0/SUCCESS)
Process: 4325 ExecReload=/usr/sbin/apachectl graceful (code=exited, status=0/SUCCESS)
Process: 20597 ExecStart=/usr/sbin/apachectl start (code=exited, status=0/SUCCESS)
Main PID: 20603 (code=exited, status=0/SUCCESS)
Syslog
Jun 9 14:36:01 f CRON[2494]: (www-data) CMD (php /var/www/avg.php)
Jun 9 14:36:57 f systemd[1]: Starting Certbot...
Jun 9 14:36:58 f apachectl[2533]: httpd (no pid file) not running
Jun 9 14:37:01 f CRON[2544]: (www-data) CMD (php /var/www/avg.php)
Jun 9 14:37:25 f systemd[1]: Started Certbot.
Jun 9 14:37:25 f systemd[1]: certbot.timer: Adding 2h 47min 35.570277s random time.
Jun 9 14:37:25 f systemd[1]: certbot.timer: Adding 1h 45min 16.226705s random time.
The last second apache were running and logging was at 09/Jun/2020:14:36:02 (it is server which receives a bunch of requests from cron from other servers once a minute, so it is totally cool that there was no log entry during the last minute).
I tried upgrading certbot but it seems it is in the last possible version.
certbot is already the newest version (0.28.0-1~deb9u2).
python-certbot-apache is already the newest version (0.28.0-1~deb9u1).
This didn't happen for the first time and I didn't find much online. What are the next steps I could do to find the caveat?
EDIT: /var/log/letsencrypt.log
2020-06-09 14:36:58,199:INFO:certbot.hooks:Running pre-hook command: apachectl -k stop
2020-06-09 14:36:58,250:INFO:certbot.main:Renewing an existing certificate
at the end
2020-06-09 14:37:25,395:DEBUG:certbot.renewal:no renewal failures
2020-06-09 14:37:25,395:INFO:certbot.hooks:Running post-hook command: apachectl -k start
Is there a way to configure certbot not using port 80 but rather some else so I don't need my apache to stop during renewal (and in the worst time possible)?