It seems the certificate chain isn’t correct.
Are all needed files there?
[root@ns8rockytest ~]# runagent -m mail1 ls tls-certs
dh.pem fullchain.pem server.key server.pem
To check the used certificate and fullchain:
runagent -m mail1 openssl verify -untrusted tls-certs/fullchain.pem tls-certs/server.pem
Maybe related: