In your nginx config the ssl_certificate value should point to the fullchain.pem (which includes the certificate and the chain). Then reload your nginx and test again.
Brilliant, thank you so much, that seems to have fixed the issue (the qualsys test now passes). Firefox is happy. I need to pop to a store and have a look at another Android tablet.