I am not relying on the automatic renewal (because my firewall normally drops external access to port 80) and instead still schedule a script that requests a new certificate each time (and deletes the old certificate when everything's ok)
Because the certificate has a new name each time (name has timestamp), setting it to the services triggers the load of the new certificate automatically, without having to restart them or to reboot the device.
I guess with the normal automatic renewal the name / id of the certificate does not change, so the services are not aware of the update.