Failure to complete Let's Encrypt renewal process

I'm having a strange Let's Encrypt issue:

Failed to request certificate : Cannot write to directory /var/cache/bind/

The cert renewal itself completes, and the cert files are copied to /home/username/ssl.cert etc. But the Apache reload is not done and then I get the above error. If I manually reload Apache the site loads with the new cert.

I've tracked this down this problem to open_tempfile_as_domain_user() in /usr/share/webmin/virtual-server/security-lib.pl but I can't figure out the call chain. This is the only function in the entire codebase that can print "Cannot write to directory".