When uploading Choose certificate type: captive portal server.
Build your pem in this order:
private key
Public key
Intermediate CA (if you have more than one include them all in the order your vendor says is 1st, 2nd etc...)
I did not have to include my vendors AddTrustExternalCARoot, but I did have 2 intermediates.