1. Don't halt the cert renewer service from ExecStartPost ops if a relying service doesn't exist; halt it if the relying service exists and doesn't restart properly. 2. Use /bin/env bash instead of /bin/bash for portability.