run curl from the server (and preferably the Checkmk SITE) with -vv and look for the SSL part.
Checkmk needs to be able to read the WHOLE cert chain and if it cant you will get issues. Checkmk cannot download the intermediate cert that a browser sometimes can.
A rule of thumb dealing with SSL in Checkmk is that you actually need to be an expert more or less in HTTPS to be able to troubleshoot this.