My website is powered by a simple Go program that uses “http.ListenAndServeTLS” to establish an HTTP server. (You feed the function the “cert.pem” file and the “privkey.pem” file.)
HTTP 400 Bad Request does not indicate an error that’s related to your SSL configuration or your certificate. That’s a HTTP error generated by your server (not sure if it could be related to go’s HTTP server implementation, or if it’s something in your application code). If there’s an issue with SSL/TLS, your server wouldn’t get to a point where it could send a HTTP 400.
Not related to this error, but your server is currently not serving Let’s Encrypt’s intermediate certificate, which will cause issues for users that have not previously visited sites using Let’s Encrypt (and thus have a cached version available). I believe the certFile parameter of ListenAndServeTLS should be set to the fullchain.pem file generated by certbot, which is a concatenation of cert.pem and chain.pem.