Turns out there was a problem with how the certificates were created. I followed another guide to create RootCA and IntCA, signed the server cert using IntCA, created a bundle using RootCA.crt and IntCA.crt, now it's working as expected.