A web administrator deployed a new TLS certificate on an internal Nginx server, but clients report the certificate is 'not trusted' even though the server certificate itself is valid and unexpired. The administrator suspects the intermediate CA certificate was not bundled correctly. Which command should be used to verify that the server certificate chains properly to a trusted CA using the organization's CA bundle?