We had an incomplete certificate for that site (only one of the two domain names was covered), almost certainly due to the reasons described in this article:
I pushed the “Renew Certificate” button here: Netlify App which fixed it up.