A new certificate chain validates while one appliance still pins the previous intermediate or key hash and rejects the same service after a control-plane upgrade

The chain is globally right and one trust consumer is still anchored to the past. The workload or policy had been stable, but the upgraded control layer now interprets one dependency differently.