A renewed intermediate certificate is deployed, but the CRL distribution point still serves the expired issuer chain

The visible cert chain looks modern, yet some clients reject it because revocation infrastructure still references the old issuing hierarchy.