I suspected it, but have now confirmed from yesterday to today, there has been some sort of change around checking certificate expiries. If the overnight job to check a cert can't get a date, it erases whatever is there. eg, we have an issue with an Exchange webmail that it isn't available currently, and overnight, it's now back to 55 years, rather than it's actual expiry date.
I updated 3 certs yesterday that can't be checked (Apple MDM token, Apple SCIM token etc) and now they don't have dates and are back to 55 years ago. This needs to revert (or a check made) that if you can't get a date, don't remove the one that's in there… No idea how many we've lost as a result…