Thanks for your reply.

I'm using https://nginxproxymanager.com/ as my reverse proxy, and using that to request client-facing certs.

The apache config is all stock, and so is the reverse proxy setup, SSL verification is disabled.

Cheers