The recommend SSL config files from https://gitlab.com/gitlab-org/gitlab-recipes/tree/master/web-server/apache generally have the SSL vhost paired in the same config file with port 80 vhost. This triggers a bug in letsencrypt: https://github.com/letsencrypt/letsencrypt/issues/2776
Simply moving the <Virtualhost *:80> … into it’s own config file solves the issue.
I hope this helps someone. GitLab is a fantastic open resource!