There are several possibilities of what is happening and it’s hard to prescribe a fix without knowing the issue.
The remote server could be using a self-signed cert, and changing it over time
The remote server could be using a self-signed cert, and you’re occasionally updating in a manner that reverts your trust store back to the default
Your Lucee installation could be very old such that the CA which trusts your remote server is not in Lucee’s trust store (possible, but unlikley)
The remote server could have purchased a new cert from a brand new CA, which is not trusted by Lucee’s trust store yet. (not likely)
You may have a local network security appliance that implements “SSL Spoofing” by swapping out the real SSL certs for self-signed ones in order to spy on SSL connections. (more common than many people realize in big corporations)
Generally speaking, no SSL reseller is using a CA that isn’t included in most recent trust stores, but it may be helpful the next time this happens to look at the server cert in question and figure out why it’s not trusted as this will help guide you in understanding what’s changing.
You can visit the site in a browser on the machine (if it’s Windows) and look at the cert there, or use the CFML code
dump( sslcertificatelist( 'hostname.com' ) )
to look at what the cert chain is that Lucee is seeing. You can then inspect your trust store (cacerts) with a tool like openssl or Portecle to see if the CA in question is in the trust store, who issued it, and how old it is.
It’s also possible to override the JRE to use its own trust store (or a trust store of your design) instead of the one baked into Lucee (this is the default in Lucee 6) if you update your JRE regularly and you trust your JRE provider to be more proactive in updating root CAs than Lucee.