DuckDNS: how to solve ERR_SSL_PROTOCOL_ERROR

I’m still struggling with this.
I’ve port forwarded on my router:
80 → 80
443 → 443
8123 → 8123

My (sanitised) config is:

lets_encrypt:
  accept_terms: true
  certfile: fullchain.pem
  keyfile: privkey.pem
token: <sanitised>
domains:
  - <sanitised>.duckdns.org
aliases: []
seconds: 300
http:
  base_url: https://<sanitised>.duckdns.org
  server_port: 8123
  ssl_certificate: /ssl/fullchain.pem
  ssl_key: /ssl/privkey.pem

Anyone have any ideas what else might be wrong or what I might be missing?

I can access my HASS via HTTP://.duckdns.org. If I port forward 443 to 8123, HTTP://.duckdns.org:443 works too. But obviously I don’t want to leave it unsecured…