Sadly, nginx doesn't have a separate SSL chain configuration option. Instead, concat site cert, CA cert, intermediate cert (middle-endian!)