To minimize chances it's a matter of my end device, I used the tools of Geocerts which allows to scan the SSL certificate on a custom port.
On mydomain.tld:8443, everything looks fine:
However, the tool also complains on mydomain.tld:8447 when the autoupdater is up, running, and scanned...