It may have been a quirk of the Riot client app. All I know is, whenever the cert got updated, the ipad app spat the dummy, although the message about a different certificate seemed to be more a basic ipad security warning than Riot-app-specific.

The Android Riot client was fine with the updated cert, other than the cert update possibly being the catalyst for needing to re-login.

This was three-odd years ago, not sure how much progress there's been since (including on my side in the use of certbot).

I use certbot to automate certificate updates on a couple of self-hosted sites, and it works fine for them - it really was just the ipad being repeatedly / repeatably finicky back then.