In the cli.ini, we have a define a third party CA/acme provisioner(incommons). so when we move the cli.ini file then incomonns no longer use and by default its lets encrypt which is in used. The firewall error is a correct error because we do no want to use lets encrypt what we want is to use out CA/provisioner. but when we use incommons that is what the error I am posting about.
Dry Run works perfectly in nginx nothing bad there. only we are getting the issue is in apache.
Note: only the dry run fails but if you set the timer to run its runs fine and renews correctly manually- only in apache.
You might want to ask InCommon to help you get a certificate from them. This forum isn't really oriented toward providing support for other certificate authorities' services.
If you do have clear indications that this is a bug in Certbot, this forum might be helpful since it's also the main de facto support channel for Certbot.
One guess is that InCommon is using /.well-known/pki-validation in its challenges instead of /.well-known/acme-challenge like Let's Encrypt does. I think Certbot is still hard-coded to attempt to satisfy the challenge under /.well-known/acme-challenge (which might possibly be a bug in Certbot's ACME implementation). It would be good if you could double check that with InCommon.