Did some more searching and found the answer on the letsencrypt forum.
Looks like I need to use fullchain.pem instead of cert.pem.
cat service.json | grep ssl
"ssl_cert_file":"/home/sbtpxyz/.ipfs-cluster/fullchain.pem",
"ssl_key_file":"/home/sbtpxyz/.ipfs-cluster/privkey.pem",
Gonna mark this one as solved.