Traefik on vmi2633427 issues no certificates and holds no ACME credentials — the browser's cert and the origin's cert are two entirely different documents, and closing the gap between them is one flag in Cloudflare's dashboard.