IIS 6.0 Reverse Proxy SSL and Android RocketChat Client (4.11) Not Working

I realize this may be a configuration issue and not a bug, if that turns out to be the case, please point me to documentation that will help me resolve this.

Description:

When the android client tries to connect to the IIS reverse-proxied SSL RocketChat server the following error is given:
java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.

Steps to reproduce:

1. Setup RocketChat
2. Set up IIS reverse proxy (SSL) to RocketChat
3. Install Self Signed Root Certificate on Android Device
4. Attempt to connect with Android RocketChat client

Expected behavior:

The android client to connect.

Actual behavior:

Client does not connect.
java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.

Server Setup Information:

• Version of Rocket.Chat Server: 3.6.3
• Operating System: Linux (Synology)
• Deployment Method: Docker
• Number of Running Instances: 1
• DB Replicaset Oplog: Enabled
• NodeJS Version: 12.16.1
• MongoDB Version: 4.4.1 (wiredTiger)

Client Setup Information

• Desktop App or Browser Version: 4.11.0.2136 (Android, Google Play Store)
• Operating System: Android 10? (Samsung Galaxy S20)

Additional context

• IIS: 6.0 (2008 R2)* (Reverse proxy to RocketChat confirmed working on various web clients, windows client)
• SSL Certificate is self-signed by the Windows Domain Certification Authority
• Root Authority Cert Package is installed on Android device
• Android Chrome shows lock icon on same device that RocketChat client fails

SSL Key Information:

RSA 4096 bits (SHA256withRSA)
Server Authentication (1.3.6.1.5.5.7.3.1)
Application Certificate Policy: Policy Identifier=Server Authentication
Key Usage: Digital Signature, Key Encipherment (a0)
Subject Alternative Name list includes rocketchat.[domain redacted]

Server (IIS) Notes:

• TLS 1.3 is not available
• TLS 1.2 is enabled
• TLS 1.1 is enabled (I have some legacy stuff that needs it)
• TLS 1.0 is enabled (I have some legacy stuff that needs it)
• SSLv2 and v3 are disabled

Additional notes

I realize that IIS 6.0 (Windows Server 2008 R2) is old, it's running as a Hyper-V VM and the hardware the host is on can't run Server 2012+, the machine is slated to be replaced but not until 2021/2022 so, just kind of stuck at the moment. (Will probably run Server 2019 when the new machine is purchased and configured.)

Plan B would be to run a reverse proxy container on the Synology (along side MongoDB and RocketChat itself) but I know less about configuring Apache and nginx than I do IIS so that isn't my first choice (also it would have to run on a non-standard port for SSL which seems to cause some issues.)

No repository file, test, or entry point is identified; this is primarily a deployment and certificate-trust report. Start by reproducing the listed Rocket.Chat 3.6.3 and Android 4.11 setup, then inspect the IIS reverse-proxy certificate chain and Android trust behavior. Done means identifying a supported configuration or documenting the required certificate setup.