fixed. seems that Le got more picky on validation with RewriteRules in the way
I am sure you guys are aware, but just in case you are not:Koozali domain certificate expired.