just to follow up on this in case someone else runs into the same thing. I needed to make sure the tls-ca secret was populated with the CA certificate. I misunderstood where the cert that was provided to me was obtained, it was an internally signed cert from an internal CA, where before I believed it was external. This works for me now.