just to extract everything away from the scripts, essentially it is this command that fails:

  ipa-server-certinstall \
          -w \
          --dirman-password="${DIRMAN_PASSWORD}" \
          -d /etc/letsencrypt/live/${FQDN}/privkey.pem /etc/letsencrypt/live/$FQDN/fullchain.pem \
          --pin=''

unless both the root and intermediary certificates from letsencrypt are installed with:

ipa-cacert-manage install XXX.pem

Which the letsencrypt people are very adamant that the intermediary certs should not be installed. And I question whether or not the root certificates would need to be installed as they are already present anyhow:

ls -alh /etc/pki/ca-trust/extracted/pem/directory-hash|grep -i isrg
lrwxrwxrwx. 1 root root   59 May 30 15:15 0b9bc432.0 -> CN_ISRG_Root_X2_O_Internet_Security_Research_Group_C_US.pem
lrwxrwxrwx. 1 root root   59 May 30 15:15 4042bcee.0 -> CN_ISRG_Root_X1_O_Internet_Security_Research_Group_C_US.pem
lrwxrwxrwx. 1 root root   59 May 30 15:15 6187b673.0 -> CN_ISRG_Root_X1_O_Internet_Security_Research_Group_C_US.pem
lrwxrwxrwx. 1 root root   59 May 30 15:15 8794b4e3.0 -> CN_ISRG_Root_X2_O_Internet_Security_Research_Group_C_US.pem
-r--r--r--. 1 root root 1.9K May 30 15:15 CN_ISRG_Root_X1_O_Internet_Security_Research_Group_C_US.pem
-r--r--r--. 1 root root  790 May 30 15:15 CN_ISRG_Root_X2_O_Internet_Security_Research_Group_C_US.pem

so should they need to be installed at all?

The entire chain is required because of misunderstandings of PKI The chain is required so that IPA can be sure that the entire chain is available for clients and servers. We've seen often enough broken chains and have to dig into custom configurations to identify basic PKI issues. So we require the full chain.
The same goes for the certificates themselves. Users often follow bad formulas for generating CAs and certificates which result in invalid or non-compliant certs.
We don't impose these restrictions arbitrarily but because we've been shown over and over how they can be abused.
This is less likely with a CA like LE which has its roots shipped in most OS's so is already trusted. It is custom PKI that generates the problems.

Thanks for all your help @rcriiten I do have a working freeipa server with a LE cert. So I guess I'll just have to maintain the scripts at freeipa-letsencrypt to ensure the list of intermediaries stay up to date.