Let's Encrypt may revoke certificates early, see https://community.letsencrypt.org/t/2020-02-29-caa-rechecking-bug/114591 Acmebot should detect the revocation via OSCP and auto-renew the certs.