Bad handshake error during renew

OpenSSL.SSL.Error: [('SSL routines', 'ssl3_get_server_certificate', 'certificate verify failed')]

It looks like your system is missing the ISRG Root X1 root certificate from your CA certificate store. The certificate chain the Lets Encrypt acme server sends changed on Sept30 due to expiration of DST Root CA X3 at that time.

Try:
sudo apt-get update
sudo apt update

Then, what shows:
sudo apt install ca-certificates

4 Likes