Synology can't get certificate

Not sure if this is normal for Synology NASes, but it is running all vhost configs as "_" ("default"):

        listen 80 default_server;
        listen [::]:80 default_server;
        server_name _;

        listen 443 default_server ssl;
        listen [::]:443 default_server ssl;
        server_name _;

There is no specifically defined section for your requested FQDN.

Please run:
nginx -T

And crop out and post the entire HTTP vhost server section that contains:

        listen 80 default_server;
        listen [::]:80 default_server;
        server_name _;