While we wait an official response, and that test server, I have found this thread on Stackoverflow where it explains how to validate this before Sandbox is updated, to make sure your server has the correct certificate installed.
Most likely it will since this is CA certificate dates from 2019 and started being included in distros at least in 2020 (that I could trace).
You'll find that certificate in most Linux distros as a symlink inside: /etc/ssl/certs, so if your server uses a Linux image, most likely will be ready:
$ file /etc/ssl/certs/USERTrust_RSA_Certification_Authority.pem
/etc/ssl/certs/USERTrust_RSA_Certification_Authority.pem: symbolic link to /usr/share/ca-certificates/mozilla/USERTrust_RSA_Certification_Authority.crt
With this path, you can run your own test:
$ openssl s_client -connect usertrustrsacertificationauthority-ev.comodoca.com:443 -CAfile /usr/share/ca-certificates/mozilla/USERTrust_ECC_Certification_Authority.crt
And it will output the correct response ✅:
SSL handshake has read 4477 bytes and written 437 bytes
Verification: OK
But if you run the same test on api.sandbox.push.apple.com:443, you'll get an error ❌:
SSL handshake has read 4691 bytes and written 438 bytes
Verification error: unable to get local issuer certificate
Let's repeat this test when Apple updates api.sandbox.push.apple.com:443.