Hate to ask this simple question, but sometime it's the simple things.
When you access CWP and goto Server Settings -> Change Hostname
It will show:
Your Hostname is: (Hotname) and it resolves to IP: 1.2.3.4 [Check Black List] [Check CWP SSL] [Check WebServers SSL]
rDNS/PTR = (Hostname) SUCCESS [Check SenderBase]
The SUCCESS should be a Green block with White letters.
If it's not, a SSL will not generate for the hostname.
Also Let's Encrypt only allows 3-4 attempts per 24 hours or something like that.
Just my 2 cents.