The --renew flag given to certbot-auto in the cronjob doesn't exist for the version that got installed on my server, and causes it to fail with an error message. The default behavior if there's an existing certificate is already to attempt a renewal, so this flag isn't necessary.