A quick thank you to @JuergenAuer
You helped me with a topic that has since been closed to replies (I was too slow, sorry).
The issue turned out to be caused by the challenge response files created by certbot receiving the wrong SELinux context label, which led to Apache being unable to read the file.