I have a question. How does the client learn about certificate update? I understand the "leaf" or "domain" update is done when the request is made, and that I

I have a question. How does the client learn about certificate update? I understand the "leaf" or "domain" update is done when the request is made, and that I as the end user don't need to do anything. However if an intermediate certificate is updated, do I now need to update the app or client (OS/browser etc)? Because I can sure see it in Google's interest to ensure clients only use the latest browsers, OS'. I suppose it becomes another "control" point. If your client cannot resolve a domain (outdated hardware/software) you're out of luck. If Google pushes changes to, for example, data collection within Chrome, they're going to want all users to update ASAP (e.g manifest V3, break older versions of chrome by rotating certificates).