Answer
Before suspecting the ingress controller's TLS certificate itself, check for a NAT rule on the firewall sitting in front of the public entry point — a NAT misconfiguration can forward public traffic to the wrong application server entirely (which is what actually presents the mismatched certificate), rather than the certificate or ingress configuration being the real problem.