it's very random. i see notices like this:
# certbot --apache renew --dry-run ;
Processing /etc/letsencrypt/renewal/MYDOMAIN.com.conf
Cert not due for renewal, but simulating renewal for dry run
Plugins selected: Authenticator apache, Installer apache
Simulating renewal of an existing certificate for MYDOMAIN.com and 3 more domains
Performing the following challenges:
http-01 challenge for admin.MYDOMAIN.com
http-01 challenge for MYDOMAIN.com
http-01 challenge for webmail.MYDOMAIN.com
http-01 challenge for www.MYDOMAIN.com
Waiting for verification...
Cleaning up challenges
Failed to renew certificate MYDOMAIN.COM with error: HTTPSConnectionPool(host='acme-staging-v02.api.letsencrypt.org', port=443): Read timed out. (read timeout=45)