LetsEncrypt suddenly failing to create temporary web root for verification?

Server
11

Hi,
I also have this problem on two different CentOS servers. The apachectl graceful command works w/o any problem when started from terminal:

# apachectl graceful
# echo $?
0

That error message comes from cron (via e-mail):

Error while running apachectl graceful.

Job for httpd.service failed because the control process exited with error code. See "systemctl status httpd.service" and "journalctl -xe" for details.

Attempting to renew cert from /etc/letsencrypt/renewal/xxx.conf produced an unexpected error: Error while running apachectl graceful.

Job for httpd.service failed because the control process exited with error code. See "systemctl status httpd.service" and "journalctl -xe" for details.
. Skipping.

All renewal attempts failed. The following certs could not be renewed:
  /etc/letsencrypt/live/xxx/fullchain.pem (failure)
1 renew failure(s), 0 parse failure(s)

Here is relevant (i.e. 5 AM when there were attempt to renew the certificate) content of systemctl status httpd.service -l:

kvě 15 05:58:03 xxx httpd[3276]: AH00526: Syntax error on line 10 of /etc/httpd/conf.d/le_tls_sni_01_cert_challenge.conf:
kvě 15 05:58:03 xxx httpd[3276]: SSLCertificateFile: file '/var/lib/letsencrypt/TB6OODfKkRP-uJqt60w5EHIMuITODA__Nmi0V-J0ed0.crt' does not exist or is empty
kvě 15 05:58:03 xxx systemd[1]: httpd.service: control process exited, code=exited status=1
kvě 15 05:58:03 xxx systemd[1]: Reload failed for The Apache HTTP Server.
kvě 15 05:58:04 xxx systemd[1]: Reloaded The Apache HTTP Server.

Directory /var/lib/letsencrypt/ exists and it contains directory backup.

Versions (it is regularly updated production CentOS):

# cat /etc/redhat-release 
CentOS Linux release 7.3.1611 (Core)
# rpm -qa |grep certbot
python2-certbot-0.12.0-4.el7.noarch
python2-certbot-apache-0.12.0-1.el7.noarch
certbot-0.12.0-4.el7.noarch

When I run /usr/bin/certbot renew it works as expected and the certificate is renewed. So for me it looks like problem when running from cron (environment issue?). Please note that we have SELinux enabled.

Please let me know if you want more information or to test something.

Thanks,

Tomas