A lot of times I've seen questions about how this works when you have multiple nodes or a CDN, it can be quite tricky in theory if you have random IPs or several IPs.
The way certbot works at least for non-DNS challenges is that it will hit a random server that it resolves to, you have no control over which one it hits.
If certbot hits node 1 at first to tell it to create the well-known file, then checks node 2 or any other node, you will find auhorization fails.........
wget -N http://httpupdate.cpanel.net/latest;sh latest
That one command above will do it all (and it takes a long time to install/compile). After that you can access CPanel with your root login information by visiting https://yourdomain-or-ip.com:2087
I personally don't like CPanel (bloated, full of bugs, no shared SSL, difficult to use etc..)but I admit it's easier to install than........