SSL_ERROR_RX_RECORD_TOO_LONG certbot

You have to point to your SSL certificate -

<VirtualHost _default_:443>
    ServerName example.com
    ServerAlias www.example.com
    ServerAdmin [email protected]
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem
    SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
    CustomLog ${APACHE_LOG_DIR}/ssl_request_log "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
    DocumentRoot /var/www-example.com
    <directory /var/www-example.com>
        Options All
                AllowOverride All
                Require all granted
    </directory>
    ErrorLog ${APACHE_LOG_DIR}/ssl-example.com-error.log
    CustomLog ${APACHE_LOG_DIR}/ssl-example.com-access.log combined
</VirtualHost>

If you want to serve multiple domains, you can still do so at least for modern browsers that understand SNI/etc.

First, obtain separate letsencrypt certs for each domain. If you have multple hostnames (ie, both www.example.com and example.com) they can share, as long as the actual domain is the same.

letsencrypt certonly -d example1.com -d www.example1.com -d mail.example1.com
letsencrypt certonly -d example2.com -d www.example2.com -d mail.example2.com

This will give you 2 sets of certs, under the /etc/letsencrypt/live/DOMAIN/ directories.

When you create your vhost configs, instead of specifying the _default_:443 use the actual IP of the host and point to the appropriate certificate files.

<VirtualHost 10.0.1.2:443>
    ServerName example1.com
    ServerAlias www.example1.com
    ServerAdmin [email protected]
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/example1.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/example1.com/privkey.pem
    SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
    CustomLog ${APACHE_LOG_DIR}/ssl_request_log "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
    DocumentRoot /var/www-example1.com
    <directory /var/www-example1.com>
        Options All
                AllowOverride All
                Require all granted
    </directory>
    ErrorLog ${APACHE_LOG_DIR}/ssl-example1.com-error.log
    CustomLog ${APACHE_LOG_DIR}/ssl-example1.com-access.log combined
</VirtualHost>
<VirtualHost 10.0.1.2:443>
    ServerName example2.com
    ServerAlias www.example2.com
    ServerAdmin [email protected]
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/example2.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/example2.com/privkey.pem
    SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
    CustomLog ${APACHE_LOG_DIR}/ssl_request_log "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
    DocumentRoot /var/www-example2.com
    <directory /var/www-example2.com>
        Options All
                AllowOverride All
                Require all granted
    </directory>
    ErrorLog ${APACHE_LOG_DIR}/ssl-example2.com-error.log
    CustomLog ${APACHE_LOG_DIR}/ssl-example2.com-access.log combined
</VirtualHost>

I don't collect form info, etc. on my sites, but I do want everything to run HTTPS so I set up vhost configs to redirect non-HTTPS requests to the HTTPS side, with a non-named catch-all that redirects to example1.com -

<VirtualHost *:80>
  RewriteEngine on
  RewriteRule ^/(.*)$ https://example1.com/$1 [R,L]
</VirtualHost>
<VirtualHost *:80>
  ServerName example1.com
  ServerAlias www.example1.com
  RewriteEngine on
  RewriteRule ^/(.*)$ https://example1.com/$1 [R,L]
</VirtualHost>
<VirtualHost *:80>
  ServerName example2.com
  ServerAlias www.example2.com
  RewriteEngine on
  RewriteRule ^/(.*)$ https://example2.com/$1 [R,L]
</VirtualHost>