Thanks for the link, it helped me get there. I followed the documentation and tutorials for nodejs/express which defined the cert and key. As your link suggested, mobile browsers are less lenient about missing intermediate ca information so adding this solved it:

    var express = require('express'),
        path = require('path'),
        http = require('http'),
        https = require('https'),
        fs = require ('fs');
    
    var app = express();
    
    var options = {
      key: fs.readFileSync('cert/rsa.key'),
      cert: fs.readFileSync('cert/rsa.crt'),
      ca: fs.readFileSync('cert/sub.class1.server.ca.pem') // needed this
    };

    https.createServer(options, app).listen(443);