Chrome starting with v66 distrusts legacy Symantec certificates. The correct fix for this is to change the certificate chain installed on your server.
For exceptions and transition options, refer to the Google Enterprise Chrome guidance: Migrate from Symantec Certificates.
As a workaround in a Windows AD domain, you may be able to use the Chrome Enterprise Policy option to disable this certificate distrust with a GPO.
EnableSymantecLegacyInfrastructure is the new policy added in v66. For details, see the documentation in the Chromium Policy List.
Just remember that this is temporary and will stop working with Chrome v73 on 1 Jan 2019, at which point all Symantec PKI will be completely distrusted.