CA issues

[lonvoice]

Trying to get auto provisioning zero touch via rps working.

We've purchased an SSL certificate from Thawte, as this was on the list of supported CAs:

Code:

 Thawte Personal Freemail CA
 Thawte Premium Server CA
 Thawte Primary Root CA - G1 (EV)
 Thawte Primary Root CA - G2 (ECC)
 Thawte Primary Root CA - G3 (SHA256)
 Thawte Server CA

And the cert looks ok if I browse to our server:

   

But it doesn't auto configure. I know it's the certificate / CA that is the issue, as if I disable trusted certificates:

   

...it works fine. Why is it not recognising the CA here?