Malformed request message, challenge is not pending?

We haven't changed the API in ways that would break such an old client. However, if you are relying on Let's Encrypt to issue certificates for tens of thousands of domains, you should certainly be keeping your client up-to-date. In other words, if you're using letsencrypt, you should make the time to upgrade to the latest certbot.

Before we dig further into debugging, I'd like to pose the question @bytecamp asked back in October: Why are you bundling so many certificates together? HTTPS virtual hosting (through the ServerNameIndicator extension) is very widely supported these days, which means you can issue one certificate per hostname. This is generally a preferable approach, since it means problems with one customer's domain don't affect your other customers.