Also found this on bboard:

In the past, SDF has been rate-limited by Let's Encrypt due to requesting a large number of certificates, which means renewals sometimes take a day or two or more. It's not ideal, but it is what it is.

Maybe they need to start staggering their renewals so all the fediverse servers don't expire at once.