Thanks, I noticed. It's caused by having many .tk-domains on the same certificate, and because those domains expired, Letsencrypt can't update the certificate automatically.
Since I only followed online instructions to set this up, I now have to figure out how to fix it.