SSL problems on www subdomain

[strarsis]

Can your workstation, that applies the ansible playbook / invokes Trellis CLI,
resolve the host with www subdomain? Because the challenge file test is actually performed on the workstation, not on the server!
Do you have any debugging configuration left on the workstation, e.g. hosts file or router appliance custom DNS records?

Also see this related discussion (and solution):

Letsencrypt could not access the challenge file

OK, no AAAA record rules out the classic IPv6 over IPv4 address for validation with Let’s Encrypt issue. Note that this error message comes from Trellis, that does a check on its own, before actually making Let’s Encrypt validate the domain (this can save quotas). So when your workstation/CI server that runs Ansible (applies the Trellis playbook) is not able to resolve the domain or fetch the file (fail2ban comes to mind), this pre-check will fail, even when Let’s Encrypt may actually be able …