So we've done some testing, and it looks like this certificate needs to be removed from the root ca bundles of Ubuntu 16.04 and earlier, as well as Debian 9 and earlier, even if these hosts are otherwise up do date (including the root certificate bundle). We've gone head and rolled out a fix, but I guess consider this a heads up.
I mean, Debian 9 isn't that old.
Its relatively easy to test -- create a host using an older, affected distribution, set the time forward to, say, 6/1/2020, and run 'curl https://crt.sh/' . You should get a ceritifcate expired error
