Yes, thank you for pointing that out.

I had recently installed new certs, but failed to point it to the ssl-bundled cert and instead it was just the main cert without the intermediates.

Things are happier now: https://www.ssllabs.com/ssltest/analyze.html?d=diff.io&hideR... "A+"