4 ms·

At a guess, Sophos isn't/wasn't trusting Let's Encrypt's own root certificate (only their cross-signed ones).