It looks they were using a free certificate from Lets Encypt. These only last for a few months.
Lets Encrypt only does "Domain Validation" so the registrant of the domain name is the only thing they check. They do not issue certificates for IP addresses.
This website works without a domain name. The traffic is still encrypted. How do we know this is really NOAA running the website at this IP address? We can check and see that the IP address belongs to AS 6629 and that AS belongs to NOAA.
It is arguable this information provides better "authentication" than the Lets Encrypt certificate. It is certainly easier to fraudulently gain control over a domain name from a domain name registrar than it is to fraudulently gain control over an IP address block from a regional internet registry or via BGP hijacking.
