certbot (Let's Encrypt SSL certificate tool) will autheticate with the staging
LE server and thus install invalid certificates by default.

Config file /etc/certbot/cli.ini
Relevant section:

# The staging/testing server
server = https://acme-staging.api.letsencrypt.org/directory
# The production server.
# server = https://acme-v01.api.letsencrypt.org/directory

It should be the other way round, with the second option uncommented instead of
the first.
(the dev.cli file uses the staging server too, but it's wanted there)