serve chain PROPERLY!
python's ssl.wrap_socket says ca_certs is meant to check CLIENT certs!
If you just cat the cert and chain in one file, it seems to work everywhere.