I have services (mail, web) on macOS High Sierra Server protected with a letsencrypt certificate and that works fine. I'd like to extend that use of letsencrypt to Open Directory, to fully get rid of all that self-signed stuff. But when I select my letsencrypt cert for OD, the clients won't work with it presenting me with a "2100" error.
Now, my certificate is for
serverhost.mydomain.tld and the server is configured as
serverhost.mydomain.tld. DNS and all that is correct.
Information on the web about 3rd party certs is generally at least 4 years old (and not helpful). So, I'm asking a fresh question here. What steps do I have to take to have OD use my letsencrypt cert in a way that it also works on clients?