@tommcgee I recently had this problem and here are a couple of things I noticed:
1. Reproducing your issue, deactivating the plugin did not revert the http->https forwarding.
2. While cert was expired, clicking to download the acme-challenge files encountered the expired cert screen and burns the acme-challenge file so that verification of it errors. I believe this is because SSL Zen changes the expected file to verify when the page reloads.
3. After burning an acme-challenge file, the DNS check also fails with non-descriptive error text, “error.”
4. There is no obvious setting to disable http->https forwarding when an admin is in this burned state described above.
5. Here’s a fix: Disable then re-enable the plugin. Your acme-challenge will be un-burned. Critical: When you go to download the challenge files click “Open in a new tab” so that you are not forced to refresh the SSL Zen page. Upload the verification files per normal and click the SSL Zen verify button – it works!
6. Alternate fix: As you mention, wait for your site’s tech support to restore a backup, etc.
The above happened to me in connection with SSL Zen v2.0.3, free plan, with WP v5.4.1