A certificate replacement installs the right chain

The chain is trusted and the identity profile is no longer what the client expects. The service still works through the primary path, but one dependency only fails when the old component is finally drained away.