Letsencrypt renewal getting - remote error: tls: handshake failure

I had Cloudflare running on the site, once I paused it I could renew the certs.

Consider specifying the http-01 method. For example,

sudo certbot renew --preferred-challenges http-01

The http-01 challenge works by generating a file at a specific web-accessible location under the domain under consideration. The challenge relies on HTTP (port 80) rather than HTTPS (e.g., the tls-sni-01 challenge method). Avoiding reliance on TLS can be a step forward in addressing the error you encounter.

The --preferred-challenges, perhaps self-evidently, cues certbot, for plugins which can handle more than one challenge method.