If you ensured both the subdomain and the domain name were provided when using certbot, then it could be a case where the server is still using a previous cert. I had issues where changing the cert in NameCheap did not immediately take affect. (In the NameCheap CPanel console, cert would be fine, but actually visiting the site would still present the old cert for a while.) There were at least a couple times where it only presented the new cert after I fully removed the old one from Cpanel. Other than that, running out of ideas.
There are several reserved names in Windows. This is for backwards compatibility with mostly DOS programs. On your desktop, try and create a folder named “con”, and Windows should flat-out refuse. (Same thing for “prn”, “aux” and “nul”)