The issue was the missing Subject Alternative Name (SAN), which was not being filled in when I generated my self signed certs using openssl. However, this excellent answerthis excellent answer explains how to generate compatible certs using open ssl.
To check if your cert contains an SAN, use openssl x509 -in my.crt -text