Edit:
Nevermind...seems not to be letsencrypt-related.
@rg305 - we manually upload this certificate to our firewall which in turn is protecting some web-resources, on-premise exchange (and more). So its the firewall that presents the certificates to outside clients accessing internal resources. If I am not mistaken automation of this is "in the works".