Client certificate rotation is healthy on the app tier but one gateway still trusts the previous intermediate only

Rotated client certs work through one path and fail through another because the gateway layer did not receive the same intermediate CA update as the application tier.