Answer
Use the Keystore functionality instead of the routing-address certificate mechanism — under Solution Manager → Users and Permissions → Keystores, import a .pfx file containing the complete certificate chain (root and intermediate certificates together) along with its keystore key (a file without one won't be recognized as a Keystore-type import); then, in the REST Call event action's own HTTP header parameters, add ssl:KeyStoreId:<YourKeyStoreIdHere> (note the header name and value are separated by a colon, not the more commonly seen comma/equals styles) — this Keystore-based approach is specifically the supported workaround for certificate trust on REST-Call-type events, which bypass the Routing Address layer entirely.