So an intermediate certificate in the replacement ssl cert chain was using sha1 instead of sha2.   
Apple apps doesn't like that apparently.   Changed certificate provider, and all is well again.   

Good 'ol 1 year mark.