A test authorization for pma.sp.gov.br to the Let's Encrypt staging service has revealed issues that may prevent any certificate for this domain being issued.
DNS problem: SERVFAIL looking up TXT for _acme-challenge.pma.sp.gov.br - the domain's nameservers may be malfunctioning