A lot of times I've seen questions about how this works when you have multiple nodes or a CDN, it can be quite tricky in theory if you have random IPs or several IPs.
The way certbot works at least for non-DNS challenges is that it will hit a random server that it resolves to, you have no control over which one it hits.
If certbot hits node 1 at first to tell it to create the well-known file, then checks node 2 or any other node, you will find auhorization fails.........
The client needs a new connection for this request as the requested host name does not match the Server Name Indication (SNI) in use for this connection.
Before reading this, I assume you've done all the proper troubleshooting and you are 100% sure the CDN and backend server is configured correctly.
This can often happen........
Just install these packages and restart the VM:
1.) Enable guest-utils on the host side:
sudo apt install virtualbox-guest-utils virtualbox-guest-x11
2.) Enable guest editions on the VMside
This must be done for each VM that you want to have the guest additons for accelerated GPU performance and for drag and drop/clipboard sharing
First insert the Guest Addtions CD image........
The best way is as below in .htaccess using modrewrite, any request that is not SSL will be redirected to https://domain.com and the exact same URL
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://domain.com/$1 [R=301,L]........