Thanks for this great feedback and TLS tip. I'm using GAE to host this, and it only has these options https://ctxt.io/2/AAAAACLGEg. Do you think this is broken or how I generated the cert?

I think I followed instructions from here to get the certs: https://github.com/arkarkark/letsencrypt-nosudo but I can try all this again.

edit: Looks like this is the solution, thanks for pointing this problem out: http://stackoverflow.com/questions/17746643/how-to-set-the-i...