If there are no errors in the log, the SSLIt jobs are active, a manual renewal works and gives you a valid certificate with a new expiration date, a certificate exists that expires and is not renewed, I think that in this case a different certificate is being processed that you are not seeing as it is possible that no only one, but two or more different certificates had been issued before for the same domain of which only one is handled automatically (in the background). However, after you have renews the certificate once, you now should have up-to-date certificate data and next renewal should work automatically.