Incomplete TLS chain: the browser gets through, curl and Python do not
“unable to get local issuer certificate” on an API that opens fine in a browser: nginx sends the server certificate without the intermediate. An nginx bench with a local PKI, the exact curl, Python and OpenSSL errors, the AIA address followed by hand, then the fix: a fullchain file.