It was a change in Let's Encrypt side and reverted to the old way a few weeks ago.
So, any certs renewed since then should have the old CN name method. If you do a one-time force renew now you should get the fix.
This is a post from later in the link orangepizza provided