:\ . Firewall? Not sure, works for me.
I can offer one speculative solution, and that’s to lower your network interface’s MTU.
It’s worked for a whole bunch of users in the past. Large packets - such as the one where the final certificate chain is sent to Certbot - tend to cause MTU issues like this to crop up to the surface.
You can try (substituting eth0 for your internet interface if necessary):
sudo ifconfig eth0 mtu 1300
and if need be, you can revert it to 1500 the same way.
To avoid hitting rate limits, test using:
sudo certbot certonly -a apache --dry-run -d your_domain -d www.your_domain