Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA. issues

Not all ISPs block port 80, and some that do will allow you to request that it be unblocked.

There is also a DNS challenge method available where you can get a certificate by making changes to your DNS zone rather than by receiving an inbound connection on port 80.