The problem is possible not, that the certificate is expired, but that LetsEncrypt change there root certificate, and older systems don't know (and also don't accept) the new root certificate. I don't know if surf use there own root certificate store, or if it use the systemwide. So I don't know witch package must be updated.