Just had a hair-tearing situation (and I already have barely any hair left) where @letsencrypt certbot simply refused to create a key/cert pair on a @debian server.
Turned out to be a domain with a mix of IPv4 and IPv6 #DNS records. #IPv4 were changed, #IPv6 not.
https://www.claudiokuenzler.com/blog/1480/lets-encrypt-certbot-error-mixed-dns-records-ipv4-ipv6
