Hi mattc,
worked pretty fine for my scenario. Since I'm running Apache2 ReverseProxies for gitlab and mattermost, I needed to add the following line in my configuration
SSLCACertificateFile /usr/local/share/ca-certificates/ORG-zcore-CA.crt
since i'm not using a self-signed certificate, but a untrusted CA for internal server.