something like that was my first thought, but it's happening in two separate clusters in different AWS VPCs. The app is keycloak, we saw this problem when initially deploying it without enabling tls pass through. I enabled that by dropping an rke2-ingress-nginx-config.yaml into

/var/lib/rancher/rk2/server/manifests

on one of the control planes.

apiVersion: helm.cattle.io/v1
  kind: HelmChartConfig
  metadata:
    name: rke2-ingress-nginx
    namespace: kube-system
  spec:
    valuesContent: |-
      controller:
        config:
          use-forwarded-headers: true
        extraArgs:
          enable-ssl-passthrough: true

Basically followed the steps from this blog https://ranchergovernment.com/blog/leveraging-rke2-with-tls-passthrough

I just added that to the Add-On Config for the cluster itself, and I'm still seeing the same thing. It doesn't make any sense to me that a refresh of the page will suddenly get the correct cert