SSL/TLS Certificate

The server sends its certificate without the intermediate certificate that links it to a trusted root. Some browsers fetch the missing piece themselves, so the site can look fine in Chrome while curl, apps, and many API and mail clients refuse the connection.

Fix: Configure the server to send the full chain: the site certificate followed by its intermediates (for Let's Encrypt, fullchain.pem rather than cert.pem).