This also bit me. I thought I was in the clear not using anything with outdated CA keystores. Turns out that some TLS implementations don't trust the connection if the server provides an expired CA in the certificate chain.
This includes the Nextcloud client for Windows and the DNS over TLS implementation in Android 11.
Adding the argument --preferred-chain "ISRG Root X1" to certbot fixes this by not chaining the expired CA X3...
I got the pop-up a week back or so. I uploaded a photo of my drivers license with everything redacted except my name and date of birth and clearly watermarked it with the purpose and current date.
It was accepted automatically within a few seconds. Can't really complain.
Put on headphones, linked to your phone, mute the phone mic (do not skip this step), and hold a video call with yourself between your computer and your phone.
Quality supercardioid microphone will reject echo well enough for most rooms and a meter or two distance. That is usually enough distance to not typically require a pop filter, this giving improved clarity.
Hypercardioid "shotgun" works too as long as its back is placed far enough off a wall, however these tend to have sound coloration.
It just so happens that most microphones are the less directional cardioid. Or worse, omnidirectional.