When FULL_CHAIN_INCLUDE_ROOT is set, DOMAIN_CHAIN_LOCATION was sending just the intermediate and server cert. Copying $FULL_CHAIN instead of $CERT_FILE+$CA_CERT fixes this.