This seems to have stemmed from Qualys caching an earlier certificate that has since been updated.
Independently, the original problem seems to have been our usage of Xdomain (a JavaScript alternative to CORS) to support older IEs used by some of our customers. The way it was being used seemed to conflict with Chrome on iOS.
I've pushed a fix to our staging servers and this will manifest in production once it has been better tested. Thanks everyone for pointing this out!