The server is not sending the G2 cross-certificate, only the R1 intermediate — so any browser/OS/device whose trust store hasn’t yet picked up the new GoDaddy R1 root (older Windows/macOS builds, some Linux distros, certain managed corporate devices, etc.) will reject the connection.

GoDaddy PKCS7 Certificate Intermediates Bundle (for Windows IIS) – DV – R1 with Cross to G2, includes Root
https://certs.godaddy.com/repository/gd_dv-r1-g2_iis_intermediates.p7b

1. certlm.msc ? Local Computer certificate store (must run as admin).
2. Right-click Intermediate Certification Authorities ? All Tasks ? Import.
3. Browse to gd_dv-r1-g2_iis_intermediates.p7b.
4. On the store-selection screen, choose “Automatically select the certificate store based on the type of certificate”

# 1. Download the R1->G2 cross-cert and add it to Intermediate CAs
Invoke-WebRequest https://certs.godaddy.com/repository/gd_tls_root-r1-cross-g2.crt -OutFile C:\Temp\gd_r1_cross_g2.crt
$x = New-Object Security.Cryptography.X509Certificates.X509Certificate2 C:\Temp\gd_r1_cross_g2.crt
$x | Select Subject, Issuer, SerialNumber, Thumbprint   # Issuer should be the G2 root; Fortinet lists serial 0090DE6C7FB3B50B3C0617724FC13402AD
Import-Certificate -FilePath C:\Temp\gd_r1_cross_g2.crt -CertStoreLocation Cert:\LocalMachine\CA

# 2. Make sure the G2 root is trusted
Get-ChildItem Cert:\LocalMachine\Root | ? Subject -like '*Go Daddy Root Certificate Authority - G2*'

# 3. Remove the self-signed R1 root from this server only, so Windows builds via the cross-cert
Get-ChildItem Cert:\LocalMachine\Root | ? Subject -like '*GoDaddy TLS Root CA - R1*' | Remove-Item

# 4. Restart so http.sys rebuilds the chain
Restart-Service adfssrv     # a reboot is safer if Chrome still sees the old chain