After contacting Sectigo, I had to install a CA bundle with cross-signed intermediate chain certificate AND delete the new root certificate on the server. That did the job. Thanks to all who helped.