Cannot upgrade certbot on ubuntu 17

While you urgently need to upgrade Ubuntu for other reasons, you can continue to use Certbot 0.25.0 (unless you run into bugs). While it uses TLS-SNI-01 validation by default, it supports HTTP-01 as well as more recent versions.

You can use this command to test how things will go:

sudo certbot renew --dry-run --preferred-challenges http-01,dns-01

If you really need to upgrade Certbot, you can use certbot-auto instead. But that's a small hassle (mainly you need to fix a systemd timer to use it) and IMO you should prioritize other things if possible.