Obtain the cross-certificate (the “bridge”) from the private CA owner and install it in the Intermediate Trust store.

Three minutes later, Liam replied: “Negative. No changes. But I’ve seen R2R before. Check your local trust store. R2R isn’t a standard CA—it’s a concept .”

Her first instinct was to blame the Dublin team. “Hey,” she messaged her counterpart, Liam. “Did you guys revoke a root CA on your load balancer today?”