I think I have that problem fixed:
pi@HomeAutomation:/etc/nginx/sites-available $ sudo certbot certonly --dry-run --webroot -w /var/www/sandbox.rpiweather.net -d sandbox.rpiweather.net,www.sandbox.rpiweather.net
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Simulating a certificate request for sandbox.rpiweather.net and www.sandbox.rpiweather.net
Performing the following challenges:
http-01 challenge for sandbox.rpiweather.net
http-01 challenge for www.sandbox.rpiweather.net
Using the webroot path /var/www/sandbox.rpiweather.net for all unmatched domains.
Waiting for verification...
Challenge failed for domain www.sandbox.rpiweather.net
http-01 challenge for www.sandbox.rpiweather.net
Cleaning up challenges
Some challenges have failed.
IMPORTANT NOTES:
- The following errors were reported by the server:
Domain: www.sandbox.rpiweather.net
Type: dns
Detail: DNS problem: looking up CAA for www.sandbox.rpiweather.net:
DNSSEC: Bogus
pi@HomeAutomation:/etc/nginx/sites-available $