nitter.net does not provide intermediate TLS cert
... which results in non-cert-caching clients rejecting the connection.

Verification:
```
$ openssl s_client -showcerts -connect nitter.net:443
CONNECTED(00000003)
depth=0 CN = nitter.net
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 CN = nitter.net
verify error:num=21:unable to verify the first certificate
verify return:1
depth=0 CN = nitter.net
verify return:1
---
Certificate chain
0 s:CN = nitter.net
i:C = US, O = Let's Encrypt, CN = R3
-----BEGIN CERTIFICATE-----
[redacted for brevity]
-----END CERTIFICATE-----
---
Server certificate
subject=CN = nitter.net

issuer=C = US, O = Let's Encrypt, CN = R3

---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 1855 bytes and written 376 bytes
Verification error: unable to verify the first certificate
[...]
```

Or alternatively, via `curl https://nitter.net/`.

If this is intentional this should be documented.

If this is an accident, the server is likely using the `nitter.net.cer` instead of `fullchain.cer` (using the naming scheme of common acme clients).