New letsencrypt CA cert since they left beta, and HTTP server now expects a Host header.
Now the site is using Let's Encrypt's root certificate.