There’s a saying “If two people tell you you’drunk – go to bed!!”
I got impatient, and tried removing all the iptables chains, and tried
sudo certbot --apache renew --dry-run again
I was wrong, you were right!! the certbot command ended successfully!
Unfortunately to restore everything I had to reboot. But now I have a workaround until I find which fail2ban rule (there are several hundred) is getting in the way,
Marking this item Solved, And thank you _az and cpu!
Mike