If you’re on Debian 8 try this on your client (that is, the server that initiates the TLS connection):
sed -i ‘s/mozilla\/DST_Root_CA_X3.crt/!mozilla\/DST_Root_CA_X3.crt/g’ /etc/ca-certificates.conf
update-ca-certificates