If you can read this over HTTPS at ecdsa-test.dmacnz.people.aws.dev, the cert chain, TLS handshake, and CloudFront viewer config all work.