Checks

Certificate chain is untrusted

The handshake could not build a chain to a trusted root.

Why it matters

A missing intermediate is a common cause. Clients then treat the site as untrusted.

What to do

Serve the leaf and the intermediate certificates, in order, from a public CA.

Reference

Certificate validity, protocol version, and cipher choice determine TLS trust and strength.

Mozilla SSL Configuration Generator