I set up my LetsEncrypt renewal cron to run just once a week. This causes certwatch to trip because it is set to alarm on any cert that needs to be renewed in < 30 days.

to adjust the Certwatch warning period in Centos 7:

Edit /etc/sysconfig/httpd and add the line:

CERTWATCH_OPTS=”-p 14″

The 14 indicates for certwatch to alarm staring on 14 days before a cert expires

Done!