Are you sure you’re using the real CA server and not the staging server?
Check if there’s a /etc/letsencrypt/cli.ini config file containing the staging server url. You could also try to add --server acme-v01.api.letsencrypt.org/directory when running the letsencrypt-auto command.