Well, sure enough, I'm using Let's Encrypt certs, curl reports errors when contacting the server, and I know from checking the logs before that Apache was making no mark in them from Mastodon instances (which first led me to believe they weren't even trying). Huh.
So I guess I'll need to look into getting better PEMs for my various LE certs. I sort of hope this won't get too out of hand...
Anyway, thanks for the advice!