be sent because of the server - begin to see the RFC extract quoted earlier mentioned) and if that's the scenario, investigating the Issuer and most likely the AKI area to verify which Root CA issued this first https://ca-none.com/