Comment (by Roland Haas):

As a side note: this certificate chain missing is not caught by: https://www.cct.lsu.edu/~knarf/cgi-bin/monitor.cgi (and the “not all” is correct, my browser is happy with the website right now).

The raw

openssl s_client -showcerts -connect einsteintoolkit.org:443 </dev/nul

does report “Verify return code: 21 (unable to verify the first certificate)” though.

--
Ticket URL: https://bitbucket.org/einsteintoolkit/tickets/issues/2249/new-tls-certificate-for-einsteintoolkitorg