StartTLSAutocert should start a go routine for certManager to accept http connections in-order to pass the initial verification callbacks from LetsEncrypt.
go http.ListenAndServe(":http", certManager.HTTPHandler(nil))
Perhaps this was not done in favour of explicit StartRedirectAll() from the app, but redirecting 80 to 443 will not work until certificate for 443 has been obtained; but it will not be obtained due to above reason.