https://crt.sh/?Identity=cmake.org - a valid certificate has been issued in May, but maybe something wasn't restarted.

I noticed on my server that the latest version of certbot (CLI tool for LetsEncrypt) broke my automatic renewal script.

This happened after the snap did an unattended update.

I had to replace the --webroot parameter with --nginx

Luckily I had monitoring [1] in place to alert me beforehand

1. https://updown.io/