When you did this, did you also update the certificate chain, not just the certificate itself? Certbot will give you both things, but if you're using --manual it's easy to forget about the chain (since, most of the time, the old chain is still correct, or still correct enough—but not right now!).
Edit: Actually, the chain looks correct to me (except that the end-entity certificate is duplicated). Can someone else confirm whether these browsers might be actively rejecting the Android workaround X3 certificate? If so, you might need to remove the X3 certificate from your chain (which is unfortunate because I think prior experiments suggested that its presence only improved compatibility with old Android systems, rather than harming compatibility with other clients).
