Thanks, Daniela! That does seem like it may be related, but I can’t tell what to do about it or how to know if a site should force getting a new certificate. I just checked a handful of sites and several have renewed in the past few days. I believe in all cases the certificate had expired (I double-checked only the one that I just fixed), so the more I think about it, the less I think this explains it–unless some of these sites had an old enough base image that it would fail to retrieve a new certificate because that base image had an out-of-date root certificate?
AH! That might explain it. Another docker-based Debian 9 site that I manage is getting errors using curl because its root image is bad.