Let's Encrypt root certificate expiring in a few days!

Your server sends the old X3, not the newer R3. Minimal a restart is required.

You have created that buggy configuration with a hardcoded intermediate certificate. Nobody knows what you have done. So it's your job to change that.