Apparently the version of win-acme I was using created a cert that powershell can't use, (but IIS Manager can.)
I've updated to a newer version of win-acme to generate the certs. The exact same powershell script is now working.