Thirteen days of silent TLS failure, and the probe that reported healthy the whole time
Certificate renewal had been failing for thirteen days. The blackbox exporter said 75 days remaining. The origin had 17. When a CDN terminates TLS, every external certificate probe you have is measuring the wrong certificate.
Read the letter