I’ll do the troubleshooting that you described. In the meantime I wanted to clarify that initial certificate request succeeded only renewal failed. It probably failed multiple times; but the engineer whose email is in the primary contact is on vacation, so we never learned that renewal was failing. I want to say that we didn’t make any changes after initial successful request… but I wouldn’t trust my clients when they say so; so I don’t expect you, either 
I did delete and requested new certificate (instead of renewal); but now new requests are failing as well.
OK, it’s not that important. Let me follow troubleshooting steps that you described