FYI, we just noticed that Chrome 98 beta rejects these certs as "lost sleep", and the FS 1.10.7 log shows "BAD READ -1". But Chrome 97 and Firefox do not show these problems.

We haven't found a resolution nor bug report, but I'll followup if we do.