Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA

No problem.

That's probably very true. I assume you're using the Debian stretch packages? Because that version is indeed very old, 0.10.2. However, the stretch-backports repository has a rather up to date version of 0.25! That's also the recommended method of installing certbot. But I don't use Debian myself, so I have no idea if you can combine stretch-backports just for certbot with the rest of your packages just stretch.

But anyway, that doesn't really matter, because even with the 0.10 there should be 2 options. See below:

Very nice! A working certificate is obviously the end goal here. However, there's still one thing I don't understand. In the workaround thread @schoen has provided, it mentions two possible workarounds:

  • "# Webroot method" (which uses --authenticator webroot)
  • "# Temporary outage method" (which uses --authenticator standalone, the one you're using)

I'm not sure why you've opted for the "temporary outage method"? Because it requires Apache to be stopped, cert to be renewd and Apache to be started again. Between starting and stopping, you're site will be down for just a moment.

The webroot method doesn't have that limitation. I'm not saying you did anything wrong, nor am I saying you should change anything, but I'm trying to figure out the reason why you opted for an option with downtime instead of the option without downtime.