Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
I ran this command: sudo certbot run -a manual -i nginx -d XXX
It produced this output: Saving debug log to /var/log/letsencrypt/letsencrypt.log An unexpected error occurred: requests.exceptions.SSLError: HTTPSConnectionPool(host='acme-v02.api.letsencrypt.org', port=443): Max retries exceeded with url: /directory (Caused by SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:897)'),)) Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
My web server is (include version):nginx -v
nginx version: nginx/1.14.1
The operating system my web server runs on is (include version): CentOS Linux release 8.2.2004 (Core)
My hosting provider, if applicable, is:
I can login to a root shell on my machine (yes or no, or I don't know): yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel): ssh
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 1.20.0
SSL certificate problem: self signed certificate in certificate chain
Closing connection 0
curl: (60) SSL certificate problem: self signed certificate in certificate chain
More details here: curl - SSL CA Certificates
curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page menioned above.
I ran this command: dig acme-v02.api.letsencrypt.org
It produced this output:
Are there other certificate-related packages that could be updated on your system? It does seem likely that the problem has to do with your trust store.
Here is a recent solution on CentOS related to this which I hadn't seen before:
If all of your certificate-related packages are already up to date, you might want to look at the solution in that thread.
This shows that your outgoing connections are being proxied by a Fortinet firewall. Your server is probably rejecting the certificate because the Fortinet firewall is intercepting these connections, and your server isn't configured to permit that (so the interception is a fatal security error). Do you know who is operating this firewall? Can you get a direct connection to the Internet that doesn't go through it?