Final missing bit is that the way I joined the components seems not to be to the liking of version 6.
cat /etc/pihole/ssl/privkey.pem /etc/pihole/ssl/fullchain.pem > /etc/pihole/ssl/combined.pem
Changing how I built combined.pem seems to have fixed everything!