You need to be explicit with the cert chains you have provided to osquery and the certs the server is offering