Correctly use notifies :immediately to order SSL key/cert generation before service restart