There is no need to restart nginx to update certificates, you can ask nginx to reload TLS certificates (`-s reload`, it actually reloads entire configuration): https://nginx.org/en/docs/switches.html

You can even reload nginx binary on-the-fly and revert this change if necessary: https://nginx.org/en/docs/control.html