I suspect it was a root CA (they possibly had a private PKI) that expired - I saw a tweet suggesting that they had to manually apply a fix to every deployment of the software, which is consistent with having to change the trust chain.