The client cert I kept as generated against the self signed root cert, I only switched the public cert over to lets encrypt. It's also bad practise to use lets encrypt signed certs as client cert.