Hi @craig.jamieson,
I believe your problem starts here:
When you try:
$ curl $NGINX_HOSTNAME:$NGINX_PORT
Does it work? I suspect it would fail…
The file ssl_certificate points to should contain both the cert and the CA, is it possible that’s not your case and that it’s missing the CA?