OK there is the problem.
the FQDN resolves to an IPv4 and an IPv6 record.
Let’s Encrypt prefers IPv6.
there is no binding to IPv6 address in your conf file.
( copied from @sahsanu from post: Let's encrypt renew certificate issue )
you can check test file access as follows:
from an Internet IP:
curl -IkL4 http://your.domain/.well-known/acme-challenge/test.txt
curl -IkL6 http://your.domain/.well-known/acme-challenge/test.txt