This looks like it's trying to use the same file for both the cert and the key? Are you doing some hook to put both in the same file?
In general, if certbot's files aren't doing what you want (in content, or permissions, or whatever), it's best to leave them alone and use a deploy-hook to copy them somewhere else, with the permissions and format you need, so that you're not messing with certbot's internal stuff.