ssl_trusted_certificate should point to chain.pem if we're demonstrating LetsEncrypt...