TLS handshake fails certificate verify

At 02:00 UTC a growing fraction of clients start failing TLS to your public API with 'unable to get local issuer certificate' / 'certificate verify failed', yet your leaf certificate was renewed last month and openssl shows it valid for 300+ days. Curl from your bastion (which has the full chain in its trust store) succeeds, but mobile clients and some partners' strict validators fail. Dashboards: handshake-failure rate climbing from 0% to ~35% over an hour, correlated with no deploy. openssl s_client -showcerts from an outside host shows the server returns leaf + one intermediate; the intermediate's notAfter is yesterday. How do you triage and mitigate?