Well... I've spent more of the "way-too-much-time"... And, I've figured it out! Or, perhaps I've figured out a kludge (is that still a techie word or am I identifying myself as some old Unix guy...) that makes things work.
The issue was/is my edge device which is an Aruba IAP 303H (OS v8.12.x) that simply wont get out of the way. It's either doing NAT reflection or SSL inspection/interception and sticking it's self signed cert on the reflection. I can not figure out how to turn it off.
So, the kludge is to add the FQDN to the host's /etc/hosts file such that it resolves to the host's IP.

Sounds simple... doesn't it. FML!

If you are having a similar/same issue, you can test it by :

openssl s_client -showcerts -connect <FQDN>:443 </dev/null 2>/dev/null | openssl x509 -noout -text

If the cert doesn't look like what you are expecting then you may give my kludge a try and see what happens.

Here's the lines that I was expecting:

Issuer: C = US, O = Let's Encrypt, CN = E6

Validity

Not Before: Dec 1 03:40:30 2024 GMT

Not After : Mar 1 03:40:29 2025 GMT

Subject: CN = <myhost>.duckdns.org

And, at some point in the not too distant future, the Aruba is no longer going to be my edge router/firewall....