Fix incomplete certificate chain errors
An incomplete chain usually means the server is missing the intermediate certificate.
Diagnose
openssl s_client -connect example.com:443 -showcerts
If only one certificate is shown, the intermediate is missing.
Fix
cat your_domain.crt intermediate.crt > fullchain.crt
Use fullchain.crt as ssl_certificate in Nginx and reload.