A certificate bundle looks current on disk but one Java client still fails

The same CA material exists, yet one client rejects the chain because its runtime path builder handles the imported chain order differently from OpenSSL-based checks.