Agent send Prolog failed with letsencrypt ssl

Debian 9
php7
OCSNG_UNIX_SERVER 2.3.1
OCSNG-Windows-Agent-2.3.0.0
OCSNG-Windows-Packager-2.3
glpi 9.1.4

I want to get green lock on my website so I use letsencrypt linux tool certbot to sign my domain.
I browse my website, everything is OK.
I try to send information by agent then got error.

==============================================================================
Starting OCS Inventory NG Agent on Monday, July 10, 2017 15:08:34.
AGENT => Running OCS Inventory NG Agent Version 2.3.0.0
AGENT => Using OCS Inventory NG FrameWork Version 2.3.0.0
AGENT => Loading plug-in(s)
AGENT => Using network connection with Communication Server
AGENT => Using Communication Provider <OCS Inventory NG cURL Communication Provider> Version <2.3.0.0>
AGENT => Sending Prolog
ERROR *** AGENT => Failed to send Prolog <Peer certificate cannot be authenticated with given CA certificates>
AGENT => Unloading communication provider
AGENT => Unloading plug-in(s)
AGENT => Execution duration: 00:00:01.

I try to debug by myself.
I got the cacert and private key by using openssl to sign same domain...no green lock :(
Then I edited the apache2 ssl conf. The Agent could send information currently.
The OCSNG Server and  Agent is worked.

So I have a problem.
The cacert.pem which made by certbot couldn't use in ocsng and agent?

There are theree pem and one private key whitch made by certbot.
cert.pem / chain.pem / fullchain.pem / privkey.pem
default ssl conf is  fullchain.pem / privkey.pem
I try use cert.pem, chain.pem and fullchain.pem to be cacert.pem in agent. All of them are unavailable.
Show me error again and again.

ERROR *** AGENT => Failed to send Prolog <Peer certificate cannot be authenticated with given CA certificates>

Someone have any idea which this?  thanks a lot.