Thawte recently started issuing a new kind of SSL cert. Instead of just taking your crt and key files and dumping them on your server, you need to install Thawte’s intermediate certificates as well. There are plenty of fine articles about why this is a good idea. Those articles are only useful after you realize that a thing such as a chained cert exists and that your IT guy has given you one. And nginx does not appear in the server matrix; bless the guy that wrote this article or I’d still be in the weeds.