Keep getting expired certificate from browser after renewal

You can force the client to keep the same lineage using --expand.