I had been running Union server continuously for the longest time ever - over 30 days,
as whatever memory leak problem I have was only causing slow growth of memory use.
During that time my SSL certificate renewed, but the old one was still usable - until today when it expired.
That I had already updated my keystore file with the new one didn't matter --- because
either Java or Union itself caches it!!
After I did a restart all was well, until the next time it expires, which is every 2-3 months.
(It has a 3 month term, but if you update it earlier you lose the overlapped time on the new one.)
Moral of the story is:
if you need to renew an SSL certificate, make sure you restart Union after that, but before the old one expires.