Seems like the cert not having an alt name should have caused failures a month+ ago when non-FIPS bouncycastle was upgraded to 1.85.