Hi there, @bbdoc
The missing certificate error in the mattermost.log suggests that the certificate chain might be incomplete. May I know what is the result that you are getting when you run the SSL Test on your domain? Can you share the results here?
You can also run the following command and share the output here. Change the parameter to the SiteURL without the https:
echo | openssl s_client -showcerts -connect <domain>:443 -CApath /etc/ssl/ && echo | openssl s_client -connect <domain>:443 2>/dev/null | openssl x509 -noout -dates -text
Since you mentioned that it works fine when you disabled TLS, it could just be a minor issue with the certificate config. Let me know how it goes on your end.