I thought this might be useful if someone else comes across the same issue.
I'm a bit of an edge case since I use docker and I create a pkcs12 cert bundle from certs and keys extracted from traefik, but the issue I had was not related to that.
Since Lets Encrypt intermediate expired my emby server has been presenting an expired intermediate, but the `p12` file I'm generating has the correct new intermediate, I narrowed it down to the x509stores in the docker image had cached the interm