Recently, DigiCert -- the Certificate Authority NOAA uses for SSL for its tides and currents API -- updated the root CA certificate NOAA's cert is based on. Since the tide clock just uses a local pem format copy of the root certificate, when DigiCert changes it, connecting to NOAA's API via SSK fails.

Keeping a local copy of the root certificate in this way is subject to this sort of change. But it's also a bunch simpler than a full certificate management solution. 

To fix the problem, I just got a copy of the pem for the new root CA certificate. When it happens again, I'll just do the same thing again.