I'm a little surprised by this. They're using an AWS Certificate which means the entire certificate lifecycle should be fully automated[1]. Assuming they use DNS validation, I speculate that somebody deleted the validation CNAME record and then the doom-and-gloom renewal emails went to an unmonitored mailbox. Then they ignored it so long it ended up on HN.
Gfycat publishes an HSTS header, so they're under _hard_ downtime too.
Most likely someone stopped paying the AWS bill. If you `curl -k` to avoid the HSTS problem you see that CloudFront and/or lambda aren't working either.
Gfycat publishes an HSTS header, so they're under _hard_ downtime too.
1: https://docs.aws.amazon.com/acm/latest/userguide/managed-ren...