Authenticator "Enable Broswer Access" error

We’ve got a fleet of corporate owned and Intune enrolled Android devices. For a couple of years, we’ve leaned on “Enable browser access” in authenticator to install a certificate for chrome and WebView browser access to MS resources. That cert passes device information usually without trouble through our CA policy. 

This week I have had two devices that are unable to recreate the cert. When attempting to rebuild it, an error pops up but is cut off. It says something to the effect, “Certificate installation was unsuccessful becau…”. Not exactly the most helpful for troubleshooting. 

So I’ve got a few questions. 
If we have already cleared all creds and user certs out of advanced security options. is there somewhere else that certificate lives? 

Are there any ways to grab the full error message, or expand the pop up error?

Is there a better way to allow webview to pass device information through to entra?

At the first webview launch with the new cert, a popup asks if we want to use the new cert for access. Where would I go to clear out that cached record? 

Thanks a bunch,

Scott