Removing the ssl and letsencrypt directories and doing a rebuild got a new cert.
This is a two-container install, so it usually does a bootstrap rather than a rebuild. I haven’t seen any issues like this with letsencrypt in a long while. I can’t tell if this is a fluke or something was broken recently.