It doesn’t seem to like sha1, could it be that the certificate from

eks.certAuth

and the certificate for the OIDC provider are different?