You were neither supposed to revoke it nor delete it. What made you think you were supposed to?
Well, that's interesting. It looks like you're getting validation requests from the secondary servers, but not the primary validation server. (I say this because you're supposed to get three connections from the secondary servers, and each of them to each of your two domain names (with the www. and without), and one connection from the primary server, and the error message from Let's Encrypt doesn't say "secondary" in it.)
I'd almost think it was another weird routing issue like this recent person who also had trouble with primary but not secondary validation, but in your case it looks like the primary requests are going somewhere, just a server that isn't expecting it somehow and is returning a 404.
This one is a puzzler.