If they’re on a corporate network, is it possible that their connection runs through a shared proxy? If so, that proxy may need to be updated. Do they get the same error when connecting to other sites like discourse.org or letsencrypt.org? If so, the issue is definitely on their end.
I think this ‘Why No Padlock?’ checker might be confused by yesterday’s Let’s Encrypt changes. Using a different scanner reports an A+ result for your site: SSL Server Test: frb.forumrossoblu.org (Powered by Qualys SSL Labs)