Very odd. The chain showed by your openssl is not the one sent by the Let's Encrypt ACME server - production or staging. It should look like the one below but yours has a copy of the expired DST Root CA X3. Do you have a proxy or firewall that is intercepting your requests?
echo | openssl s_client -connect acme-v02.api.letsencrypt.org:443 | head
depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = R3
verify return:1
depth=0 CN = acme-v01.api.letsencrypt.org
verify return:1
If you do not believe me 
you can see the chain using a website such as this
Tip: place three backticks before and after output so it formats nice. Like:
```
output
```