I have been looking into this.
If you try and request a certificate from Google trust services directly we get this issue in the certbot logs:
acme.messages.Error: urn:ietf:params:acme:error:rejectedIdentifier :: The server will not issue certificates for the identifier :: Problem(s) occurred while validating identifiers within the new-order request, see the subproblems field for specifics.
Problem for ipschool.spb.ru: urn:ietf:params:acme:error:rejectedIdentifier :: The server will not issue certificates for the identifier :: These domain names are listed as protected: spb.ru due to Specially Designated Nationals (SDN) sanctions, Office of Foreign Assets Control, Dept. of Treasury, US
2025-05-16 10:23:35,988:ERROR:certbot._internal.log:An unexpected error occurred:
2025-05-16 10:23:35,989:ERROR:certbot._internal.log:Problem(s) occurred while validating identifiers within the new-order request, see the subproblems field for specifics.
The domain spb.ru is associated with entities that have been sanctioned by the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC). Specifically, the SPB Exchange (Public Joint Stock Company SPB Exchange) was added to the Specially Designated Nationals (SDN) list on November 2, 2023, under Executive Order 14024, which targets entities operating in sectors of the Russian economy supporting its military-industrial base.
It seems like the Lets encrypt and still issuing certs for these domains.