Hangs on “Update certificates”

[brandonweiss]

I see:

✔ Contact letsencrypt server
✔ Authorize brandonweiss.me
✔ Authorize www.brandonweiss.me
⠼ Update certificates

It just hangs on the last bit. If I kill it and run heroku certs I see a certificate:

Name               Common Name(s)                        Expires               Trusted  Type
─────────────────  ────────────────────────────────────  ────────────────────  ───────  ────
dinosaur-42591  brandonweiss.me, www.brandonweiss.me  2017-06-02 20:58 UTC  True     SNI

But if I try to curl -vI https://brandonweiss.me I get:

* Rebuilt URL to: https://brandonweiss.me/
*   Trying 54.243.113.132...
* TCP_NODELAY set
* Connected to brandonweiss.me (54.243.113.132) port 443 (#0)
* SSL certificate problem: Invalid certificate chain
* Curl_http_done: called premature == 1
* Closing connection 0
curl: (60) SSL certificate problem: Invalid certificate chain
More details here: https://curl.haxx.se/docs/sslcerts.html

How can I help debug this?