4d875288a1
Let's Encrypt rotates intermediates (E8 -> YE1) which broke the pin. Pin the stable root (valid until 2035) and rebuild chain against system trust store for verification.