The ingresses referenced a Cloudflare OriginIssuer 'prod-issuer' whose CRD and controller are not installed in the cluster, so cert-manager could not issue certs and Traefik served a default cert (invalid SSL). Switch to the existing letsencrypt-prod ClusterIssuer with specific hostnames + per-app secrets, matching the working ingresses (http-01 cannot issue wildcards).