Guard HTTP to HTTPS IP certificate staging

backend/internal/nginxgateway/gateway.go

@@ -348,6 +348,16 @@ func certificateExists(domain string) bool {
 		!time.Now().Before(leaf.NotBefore) && time.Now().Before(leaf.NotAfter)
 }
 
+// CertificateReady checks that the installed leaf is valid for the target host.
+func CertificateReady(host string) bool { return certificateExists(host) }
+
+// CheckIPCertificateSupport fails before changing a live site when the
+// Certbot service cannot issue and renew a short-lived IP certificate.
+func CheckIPCertificateSupport(host string) error {
+	_, err := ipCertificateArgs(host)
+	return err
+}
+
 func ipCertificateArgs(domain string) ([]string, error) {
 	// The scheduled systemd service on supported hosts must use the same Certbot
 	// binary as interactive issuance, or six-day certificates may expire.