At some point in April 2026, ZeroSSL changed the contents of the intermediate bundle that they serve via ACME.
This change unfortunately breaks compatibility with older devices (Android 4, webOS 3/3.2, Tizen SSSP5) where devices are not regularly receiving root CA list updates.
Adding an additional cross-signature to the intermediate bundle to AAA Certificate Services reinstates compatibility for those devices with the new certificates.
ACME is designed to do this in an automatic way, and so scripting is needed to ensure that the intermediate is added back in each time a new certificate is issued.