Thanks for sharing this configuration. This looks correct to me, and so I'm not sure why it would fail to renew the way you saw.
My first guess is that there is some feature in your nginx configuration which this old version of Certbot doesn't understand properly, but that might be understood by a newer version. Could you upgrade to a newer Certbot version?
Note that step 4 here calls for you to remove your existing Certbot package (which was probably installed with apt). This is not harmful to your certificates and certificate renewal configuration, as long as you don't use --purge when removing the package.