nextdns: nextdns service on Unifi USG fails sometimes with cerificate signed by unknown authority

Context

• CLI Version: 1.34.2
• Platform: Unifi USG3P

Sometimes the nextdns just stops working with the below error:

Jul 15 14:23:11 USG nextdns[4210]: Endpoint provider failed: &{dns.nextdns.io https://dns.nextdns.io#45.90.28.0,2a07:a8c0::,45.90.30.0,2a07:a8c1::}: exchange: roundtrip: x509: certificate signed by unknown authority

If I curl the endpoint with certificate chain verification disabled I get:

admin@USG:~$ curl -vk https://dns.nextdns.io
* About to connect() to dns.nextdns.io port 443 (#0)
*   Trying 119.252.95.133...
* connected
* Connected to dns.nextdns.io (119.252.95.133) port 443 (#0)
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS handshake, Server key exchange (12):
* SSLv3, TLS handshake, Server finished (14):
* SSLv3, TLS handshake, Client key exchange (16):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSL connection using ECDHE-ECDSA-AES128-GCM-SHA256
* Server certificate:
*        subject: CN=dns.nextdns.io
*        start date: 2021-05-20 23:00:04 GMT
*        expire date: 2021-08-18 23:00:04 GMT
*        issuer: C=US; O=Let's Encrypt; CN=E1
*        SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.

It appears that the certificate chain served up by NextDNS isn’t in the CA certificate trust store of the Unifi USG.