ERR_SSL_PROTOCOL_ERROR oly through the edge is usually a protocol mismatch, not a cipher list. From the proxy, open TLS to the origin on port 443 with SNI set to the hostname the proxy dials and print the chain. An immediate abort means the origin speaks plain HTTP on 443, or the edge still uses HTTP while the origin redirects to HTTPS and the hops loop. A finished handshake that fails verify means the cert names omit that origin hostname or the intermediate is missing. Strict mode checks the dialed name, not the public name. Test the nginx config, reload only if it passes, then compare origin headers with edge headers to see which hop still serves the old cert.