certbot had been using the default config directory (which includes the certificate store) in /etc/letsencrypt. This meant that on system upgrade, certs would be regenerated on boot. This worked but is improper, and it is a possible point of failure, and certainly a cause of delay, during the boot config load. Move the config dir to /config/auth so that it will persist under system upgrade. The change is invisible to the config file, and so does not require migration.