@ned I figured out what’s going on here. Let’s Encrypt has “upgraded” to their new authority X3. We were hardcoding their X1 intermediate certificate which is incompatible with X3.
I’ll be updating Trellis very soon to switch to X3 which is their new default.
More here: https://letsencrypt.org/certificates/