Can you update the certificate without taking down your nginx server? I assume you need port 443 for LE to verify your domain, right? Can you use a different port?
Yes, use the "webroot" method of the official Let's Encrypt client.
I see, thanks.
I use the docker container "version", so I assume I have to somehow mount a volume to the container, that's also accessible from my nginx ( or whatever ) container, so it can serve the static file LE creates.
Is there something more to it?
sure - run the renewal from a different server
You can do it on the same server without downtime by using the "webroot" method of the LE client.