The fault browsers hide from you
A certificate is only trusted if there is an unbroken path from it to a root the client already trusts. Your server is supposed to send the intermediates that make up that path.
When it does not, browsers usually paper over it. They have cached intermediates from other sites they have visited, so they fill the gap themselves and the site loads perfectly.
Nothing else does. API clients fail. Fresh devices fail. Payment integrations fail. Anything without that cache refuses the connection, and it is close to impossible to reproduce from the machine you built the site on, because your browser has the missing piece.
How to fix it
Almost always you are serving the wrong file. Your certificate authority gives you both a certificate and a bundle, and the server needs the full chain rather than the certificate alone. In nginx that is ssl_certificate fullchain.pem, not cert.pem.
More in the fix guide.