Concerning certificate: i think the last to lines of your config file should be removed. The logic in the letsencrypt package is probably not clever enough to handle the loop with the IPv4 and IPv6 addresses.
Concerning "failed to redirect '404': exceeded recursion limit of 3": This means that the server wants to serve a page called "404" for handling "page not found" errors, but does not find that page. There are several improvements in this regards in the development branch of OpenACS. .... I know what's going on: You are using the newest openacs config file from bitbucket, which is expected to work with the newest release of openacs.
You can change the config file to change the path of the error files to some different, or place the error files like in [1] under
packages/acs-subsite/www/shared/
These changes should be probably backported to 5.9.1 such that the config files works out of the box.
-gn
[1] http://cvs.openacs.org/changelog/OpenACS?cs=MAIN%3Agustafn%3A20180219180844
