Just in case someone else hits a wall on this issue, make sure you save the cert in .pem format, not .der. If you saved in the wrong format, you can convert with this command:
openssl x509 -in DigiCertGlobalRootG2.der -inform DER -outform PEM -out DigiCertGlobalRootG2.pem
You can download it correctly using this:
openssl s_client -showcerts -connect mqtt3.thingspeak.com:8883 </dev/null | openssl x509 -outform PEM -out DigiCertGlobalRootCA-2.pem