thanks kirill_l! Spent 2 days on this...and adding the CA to the ACM > "certificate chain (optional)" field resolved for me.