Perhaps you can try `certbot renew --dry-run` just to see if that works? Or perhaps `certbot --test-cert` ro verify letsencrypt could be reached.   And just to be really sure: can you ping from within the NPM container to the internet?