appears the issue was nss updating and not restarting apache, sigh