I think I got certificate working. I am sure I fixed sites-available/acme.conf yesterday, I was working with a colleague so unlikely we both missed. But acme.conf was now again with Code: > Order allow,deny > Allow from all instead of Code: < Require all granted Now with Require all granded, running ispconfig_update.sh --force got the certificate OK. Also websites get certificate when ticking Let's Encrypt. Mysterious happening. What broke it? And is ISPConfig resync writing erroneous acme.conf? I'm quite sure I have not modified acme.conf before yesterday.
I have not looked into the code, but I doubt that resync is changing it as resync only changes the config files used by the website and not the ones that are only set at install time or during ispconfig update.