Emergency: acme.sh and its directory vanished

Im runnig a production system on Debian Trixie. Yesterday an SSL certificate was up for renewal. But it did not renew, acme.sh is wiped from the disk instead.
The only mentioning of acme.sh I could find is in crontab:
"41 18 * * * "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh" > /dev/null"
Certificates are in place, but expired, so I cannot even start the ISPconfig home page.
Is there any way to recover or do I have to reinstall ISPconfig from scratch and restore the production website?
Regards;

 

cat /etc/os-release
PRETTY_NAME="Debian GNU/Linux 13 (trixie)"
NAME="Debian GNU/Linux"
VERSION_ID="13"
VERSION="13 (trixie)"
VERSION_CODENAME=trixie
DEBIAN_VERSION_FULL=13.5
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org


The whole configuration is not older than 3 months. And I know it's hidden or at least was.
Here are the remains:

ls -alht
total 56K
drwx------ 7 root root 4.0K May 20 16:38 .
-rw------- 1 root root 10K May 20 16:30 .bash_history
drwxr-xr-x 18 root root 4.0K May 20 16:21 ..
-rw------- 1 root root 49 May 20 16:17 .lesshst
-rw-r--r-- 1 root root 66 Feb 24 19:58 .selected_editor
-rw-r--r-- 1 root root 3.5K Feb 24 19:14 .bashrc
-rw-r--r-- 1 root root 807 Feb 24 19:13 .profile
drwx------ 2 root root 4.0K Feb 24 18:59 .ssh
drwx------ 4 root root 4.0K Feb 24 12:50 .config
drwx------ 4 root root 4.0K Feb 24 12:50 .cache
drwxr-xr-x 3 root root 4.0K Feb 23 19:02 .local
drwxr-xr-x 4 root root 4.0K Feb 23 17:01 oriweb
and

ll /var/www/opse.wbiat.de/ssl/
total 8
-rw-r--r-- 1 root root 2848 Feb 19 18:18 opse.wbiat.de-le.crt
-rw------- 1 root root 227 Feb 19 18:18 opse.wbiat.de-le.key (Feb 19 was the installation day of ISPconfig, too.)


ll /etc/postfix/smtpd.*
lrwxrwxrwx 1 root root 48 Feb 19 13:46 /etc/postfix/smtpd.cert -> /usr/local/ispconfig/interface/ssl/ispserver.crt
lrwxrwxrwx 1 root root 48 Feb 19 13:46 /etc/postfix/smtpd.key -> /usr/local/ispconfig/interface/ssl/ispserver.key

I did not even touch the system yesterday, today the certificates expired and browsers refuse to access the website-

 

This is my first server of 40 or more, where I did not backup .acme.sh
Okay, I'll try your advice. Still I'd like to know what really happened.

 

Running again. Thanks alot Hacker is nearly impossibe and highly unlikely. The only manually started root activity which has happened since installation was the upgrade to Trixie 13.5. How this could wipe the whole .acme.sh directory, no idea.

 

Is some explanation in here?
ll -th /var/log/ispconfig/acme*
-rw-r----- 1 root root 65K May 20 18:41 /var/log/ispconfig/acme.log
-rw------- 1 root root 29 May 20 00:02 /var/log/ispconfig/acme.log.1.gz
-rw------- 1 root root 29 May 19 00:02 /var/log/ispconfig/acme.log.2.gz
-rw------- 1 root root 29 May 18 00:02 /var/log/ispconfig/acme.log.3.gz
-rw------- 1 root root 29 May 17 00:02 /var/log/ispconfig/acme.log.4.gz
-rw------- 1 root root 29 May 16 00:02 /var/log/ispconfig/acme.log.5.gz
-rw------- 1 root root 29 May 15 00:02 /var/log/ispconfig/acme.log.6.gz
-rw------- 1 root root 29 May 14 00:02 /var/log/ispconfig/acme.log.7.gz
-rw------- 1 root root 29 May 13 00:02 /var/log/ispconfig/acme.log.8.gz
-rw------- 1 root root 29 May 12 00:01 /var/log/ispconfig/acme.log.9.gz

 

These logs seem to be empty:

-rw------- 1 root root 29 May 20 00:02 /var/log/ispconfig/acme.log.1.gz
-rw------- 1 root root 29 May 19 00:02 /var/log/ispconfig/acme.log.2.gz
-rw------- 1 root root 29 May 18 00:02 /var/log/ispconfig/acme.log.3.gz
-rw------- 1 root root 29 May 17 00:02 /var/log/ispconfig/acme.log.4.gz
-rw------- 1 root root 29 May 16 00:02 /var/log/ispconfig/acme.log.5.gz
-rw------- 1 root root 29 May 15 00:02 /var/log/ispconfig/acme.log.6.gz
-rw------- 1 root root 29 May 14 00:02 /var/log/ispconfig/acme.log.7.gz
-rw------- 1 root root 29 May 13 00:02 /var/log/ispconfig/acme.log.8.gz
-rw------- 1 root root 29 May 12 00:01 /var/log/ispconfig/acme.log.9.gz

So the vanishing took place before May 12 and therefore not in connection with a renewal.
How does ISPconfig handle acme.sh certificates not belonging to any defined site? Like if it looks a certificate has not been created initiated by ISPconfig?

 

Thank you very much. It will stay a mystery then and as I control the domain stealing certificates would be useless outside a LAN.