Google Admin SDK - watch users with Let's Encrypt secured endpoint

I'm doing PoC of some GSuite custom solution which needs to listen to changes on users resource. I've created a GSuite account, linked it (and verified) with mytestdomain.com. It's also verified in API console. Basically followed instructions from https://developers.google.com/admin-sdk/directory/v1/guides/push and fulfilled all requirements from there.

Unfortunately when I try to register my web hook I'm getting following error:

Watch request denied by backend [403]
Errors [
    Message[Watch request denied by backend] Location[ - ] Reason[watchDenied] Domain[push]
]

I stuck with it and don't know where too look for more details about that error. I'm using a certificate generated by Let's encrypt, but tested it with https://www.ssllabs.com/ssltest/ and got rank A. How to check if Google API treats Let's Encrypt as trusted CA?

Solution

Problem wasn't anyhow related to Let's Encrypt certificates. They're working just fine with Google's push notifications. I've contacted with Google support and with their help I've established that sending a request with showDeleted parameter set to true was a root cause of above problem.

Support guy claimed that documentation was copied from list method and that parameter cannot be used with watch method and they're going to update docs of watch method in API reference. (However it's still there).