/etc/letsencrypt/$DOMAIN contains the keys and certificates for $DOMAIN.
The following files are found in this directory:
privkey.pem
The private key for the certificate. This file must be kept secret, but the web server needs to have access to this file for SSL/TLS to work (see also the Apache directive SSLCertificateKeyFile and the Nginx directive ssl_certificate_key and /etc/nginx/conf.d/xyz.domain.tld.conf).
fullchain.pem
The certificate file that contains all certificates including server certificate (aka leaf or end-entity certificate). This file is used in most server software. (See also the the Apache directive SSLCertificateKeyFile and the Nginx drective ssl_certificate directive (see /etc/nginx/conf.d/xyz.domain.tld.conf).
chain.pem
Used for OCSP stapling in Nginx >=1.3.7.
cert.pem
The server certificate by itself. It Will break many server configurations, and should not be used without reading further documentation
Sometimes (or always), these files are actually symlinks to /etc/letsencrypt/archive/$DOMAIN/…
These files are automatically updated (renewed) (by certbot?).