Hi, sorry for the late reply.
I’m quite sure Nginx is not intermittently presenting an invalid certificate. There’s only one vhost and it is configured to always use that certificate. I mean, it would be unheard of that Nginx would just bug out like that.
Please disregard the error 521 thing, that actually turned out to be something else.
I’m not sure what kind of extended logging could be done, if you have suggestions please let me know.
I shall insist on my theory that CF is slowly rolling out a bogus update to their servers. The error rate is already at 5% and keeps going up every day.