Comment by regecks

Strange and potentially busted, if that interpretation is correct.

What if your ACME client is updating the certificate and private key when an nginx connection comes in?

You can't atomically update both files, right? So nginx will potentially see a mismatched key and certificate?

:\

I hope it's guarded by SIGHUP, like sibling comment suggests.