The 403 is a "forbidden" response from your system. And, that it says "Secondary" means the primary Let's Encrypt center succeeded but one or more of the (currently 4) secondary centers were blocked by you.
It looks like you have geographic blocking as a test site shows this in part of the message:
Network Security ApplianceThis site has been blocked by the network administrator.Block reason: Gateway GEO-IP Filter Alert
For an HTTP Challenge you'll need to open port 80 for access from anywhere. An alternative might be to use a DNS Challenge as long as your authoritative DNS Servers are available worldwide.
See this wiki for details and other options: Multi-Perspective Validation & Geoblocking FAQ