A green lock in one browser is not proof the full chain is present on every edge path. Prefer serving leaf plus intermediates in the order clients expect, keep the trust anchor out of the served bundle when the platform already ships it, and align OCSP stapling so mobile and corporate resolvers do not stall on a missing intermediate. Treat chain completeness as a release gate for any CDN or load-balancer certificate swap.

Ops prove-out after rotating or rebinding a cert: fetch the hostname from a clean client path and inspect the presented chain depth and issuer sequence, then repeat from a second network to catch POP-local stapling gaps. Watch handshake failure rate and cert-verify errors for one deploy window — a spike limited to older clients usually means an intermediate was dropped from the bundle. Keep the prior cert attached on a canary Host until the new chain proves out under peak, so a bad intermediate does not take the whole edge dark.