Root CAs do not sign server certificates directly; they sign through intermediate certificates. The client only knows the root from its trust store. To build the chain, the server must send its own certificate plus all intermediates.
With Let's Encrypt that is fullchain.pem, not cert.pem. In nginx the full chain goes into ssl_certificate; in Apache 2.4.8 and later into SSLCertificateFile as well.
A missing intermediate often goes unnoticed in desktop browsers, which fetch or cache missing certificates. Android apps, curl, Java applications and mail servers fail with unable to get local issuer certificate.
Example
openssl s_client -connect example.com:443 -servername example.com -showcerts