Answer
Verify what certificate the server is actually presenting directly from a client machine using OpenSSL rather than relying on the browser: openssl s_client -connect <fqdn>:443 shows the real certificate chain being returned to that connection. If it still shows the old certificate from there, check for a proxy sitting between the client and the server that might be caching or terminating TLS with a stale certificate of its own — running the same openssl s_client check from a network path that bypasses any such proxy isolates whether the problem is a client-side cache (already ruled out) or an intermediate proxy independently serving a stale certificate.