diff --git a/tools/nextwks-tool/main.go b/tools/nextwks-tool/main.go
index 787475f..3a24a0e 100644
--- a/tools/nextwks-tool/main.go
+++ b/tools/nextwks-tool/main.go
@@ -60,7 +60,7 @@ func runCert(args []string) {
 		log.Fatalf("Failed to create backup dir: %v", err)
 	}
 
-	// Check if all domains have valid certs in backup
+	// Check if all domains have valid LE certs in backup
 	needIssue := false
 	for _, domain := range domains {
 		certFile := filepath.Join(*backupDir, domain, "fullchain.pem")
@@ -69,9 +69,15 @@ func runCert(args []string) {
 			needIssue = true
 			break
 		}
-		// Check expiry
-		if isCertExpired(certFile, 7*24*time.Hour) {
-			log.Printf("[INFO] Cert for %s expires soon or is invalid, reissuing", domain)
+		// Check if cert is from LE (not self-signed fallback)
+		if !isCertFromLE(certFile) {
+			log.Printf("[INFO] Cert for %s is not from Let's Encrypt (self-signed fallback), reissuing", domain)
+			needIssue = true
+			break
+		}
+		// Check expiry (renew if within 30 days)
+		if isCertExpired(certFile, 30*24*time.Hour) {
+			log.Printf("[INFO] Cert for %s expires soon, reissuing", domain)
 			needIssue = true
 			break
 		}
@@ -274,6 +280,25 @@ func fileExists(path string) bool {
 	return err == nil
 }
 
+func isCertFromLE(certFile string) bool {
+	data, err := os.ReadFile(certFile)
+	if err != nil {
+		return false
+	}
+	block, _ := pem.Decode(data)
+	if block == nil {
+		return false
+	}
+	cert, err := x509.ParseCertificate(block.Bytes)
+	if err != nil {
+		return false
+	}
+	if len(cert.Issuer.Organization) > 0 {
+		return strings.Contains(cert.Issuer.Organization[0], "Let's Encrypt")
+	}
+	return false
+}
+
 func isCertExpired(certFile string, threshold time.Duration) bool {
 	data, err := os.ReadFile(certFile)
 	if err != nil {