A new certificate chain validates while one appliance still pins the previous intermediate or key hash and rejects the same service during a failover rehearsal

The chain is globally right and one trust consumer is still anchored to the past. Normal traffic masked the issue until the standby or alternate path became active under rehearsal conditions.