It seems there's substantial delay, but it does eventually propagate. After almost 24h I'm now seeing the cert being served from both CDNs I was updating. It may be the case that doing invalidations on the / path helps as the other one tha…