Yes, it is solved with the proper cert configuration.

I hadn't fully validated some advanced SSL options like OCSP stapling as I was first trying to get all the basics working.
Since my browsers all validated the certificate chain without issue, I had assumed they were installed properly.
I've had the issue with including the full chain (or at least the intermediate) in the cert file before with some other web server products, but in those cases none of the clients would properly connect without it.

I've looked at the link you send on the ngx_stream_core_module and googled a bit more about it. While I see some documentation talking about configuring, I don't really see much in the way of exactly explaining its use cases. Best I can tell it is used for load balancing options - but I'm not sure how they would apply in this case?