Hi, This is most likely related to the expiration of the DST X3 root certificate.
Your server is correctly providing the certificate chain Let's Encrypt recommended, however it seems that this chain works less well than it was intended to.
You can switch to a chain that avoids using DST Root X3 by first making sure certbot is updated to version 1.12.0 or newer, and then adding the command line flag --preferred-chain "ISRG Root X1" when requesting a certificate.