In 2014 the enterprise wildcard certificate was renewed onto SHA-2, and the older client software on the endpoint estate could not validate it.
What should have been a routine public key infrastructure change propagated out into the fire service: application access, mobile mail, and the station alerting and dispatch terminals in more than seventy fire stations. The operational impact was crews not being notified when a run came in.
The decision
The resolution was a deliberate split rather than a rollback. A second certificate was issued under the older algorithm for the application delivery service alone and installed on its gateways — knowingly accepting a weaker algorithm on one service in order to keep a life-safety fleet functioning while the endpoints were brought forward.
That is the shape of the decision worth recording: not which algorithm is stronger, which was never in question, but which service you are willing to leave weak, for how long, and what you put in place to watch it. A rollback would have been cleaner to describe and would have left every service on the old algorithm instead of one.
Verification ran through the fire communications center, confirming with named stations that dispatches were arriving again. A dashboard would not have been evidence.
Why it is filed next to post-quantum
This is the post-quantum problem in miniature and fifteen years early.
An algorithm transition is not defeated by the cryptography. It is defeated by the oldest thing still on the network, and by nobody having an inventory of what that is. Documentation describes the cryptography an estate was designed to use; it does not describe the client that has not been updated since before anyone currently employed arrived.
Which is why crypto-agility work starts on a capture platform rather than on a cipher suite — and why having been on the receiving end of one of these in production, with a life-safety consequence attached, is a different kind of qualification than having read about the transition.
Outcome
Life-safety dispatch restored by an explicit, time-boxed exception rather than a rollback, verified station by station.