Thanks for that rundown! Yeah, we never got the memo 
We created a new cert chain with https://www.tbs-certificates.co.uk/FAQ/en/USER-Trust-RSA-Certification-Authority.html, deployed to our servers and magic happens. This one expires in 2028 
Fun morning for sure!
Thank you everyone for your patience.
