One would think to rotate their certificates months prior to expiration. Or even the bare minimum “setting up a calendar event.”

“All extensions disabled due to expiration of intermediate signing cert”

https://bugzilla.mozilla.org/show_bug.cgi?id=1548973