“Solved”-ish. I found these threads:
The problem is apparently related to big requests sent using IPv6. Since I didn’t want to hardcode the address of the API webserver into /etc/hosts, I wrote a wrapper script that reads the IPv4 address from DNS and updates the file prior to running certbot. It seems to be working.