The following fixed the issue on AWS EC2:

unset PYTHON_INSTALL_LAYOUT

/root/.local/share/letsencrypt/bin/pip install --upgrade certbot

find /path -printf '%T+ %p\n' | sort -r | head

Install awscli locally. In this case with brew on a mac:

brew install awscli

Configure the cli:

aws configure

AWS Access Key ID: IAM credential with necessary access
AWS Secret Access Key: IAM credential with necessary access
Default region name: e.g. eu-west-1
Default output format [None]: Leave as none

Now export all instances in this region to csv file:

aws ec2 describe-instances --output text --query 'Reservations[*].Instances[*].[InstanceId, InstanceType, ImageId, State.Name, LaunchTime, Placement.AvailabilityZone, Placement.Tenancy, PrivateIpAddress, PrivateDnsName, PublicDnsName, [Tags[?Key==`Name`].Value] [0][0], [Tags[?Key==`purpose`].Value] [0][0], [Tags[?Key==`environment`].Value] [0][0], [Tags[?Key==`team`].Value] [0][0] ]' > instances.csv

1. Download latest version:

curl -O https://dl.eff.org/certbot-auto

2. Mod script:

chmod +x certbot-auto 

3. Move location:

mv certbot-auto /usr/local/bin/certbot-auto

4. Generate SSL

/usr/local/bin/certbot-auto certonly --standalone -d example.com

5. New certificates will be generated and saved here:

/etc/letsencrypt/live/

openssl rsa -des3 -in originalkey.pem -out passwordprotectedkey.pem.encrypt

Enter and verify a password of your choosing