Reissue of certificate fails

Is your firewall from the Palo Alto brand? See Palo Alto firewall users with failing HTTP-01 challenges: enable "acme-protocol"

@MikeMcQ Wanna do some Palo Alto debugging? You had some nice tricks I believe to test this.