Thank you, the same directions also appear here if it helps: Installing a LetsEncrypt SSL Certificate - Zimbra :: Tech Center
I was hoping to be able to use certbot to fix the the chain (e.g. force --preferred-chain, etc). Is the answer to nuke the existing certificate and issue a brand new one?
My openssl is v.1.0.2g so I can update it although I don't quite understand how the chain issue would be related.
Thank you!