Well, that was weird. The widerweb.org web cert appeared to be expired to browsers but certbot was convinced that it was still valid. I asked it to reinstall the same cert and now browsers receive a cert with a few more months on it.