If you have set a custom “Access Control Profile” for a Virtual Host site configured by Synology Web Station (see below picture), where the profile restricts external access to the site, it also results in failing updates for the Let’s Encrypt Certificates.

I have found no work-around so far, other than removing the access control profile.