A maddening TLS failure: the site loads fine in your browser, but curl, API clients, and health checkers reject it with unable to get local issuer certificate. The certificate isn't expired or wrong — the server is sending only its leaf certificate and omitting the intermediate chain.
Why browsers hide the bug
Browsers cache common intermediate CAs and can often fill the gap themselves, so they build a valid chain anyway. Non-browser clients don't — they need the server to present the full chain. That's why "it works in Chrome" is not proof your TLS is correct.
Confirm what the server actually sends
openssl s_client -connect api.example.com:443 -servername api.example.com </dev/null # "Certificate chain" should list the leaf AND intermediate(s). # Only one cert, or "verify error:num=20" = incomplete chain.
Serve the full chain
The usual cause is pointing the server at cert.pem (the leaf) instead of fullchain.pem (leaf + intermediates). In nginx:
ssl_certificate /etc/letsencrypt/live/api/fullchain.pem; # not cert.pem ssl_certificate_key /etc/letsencrypt/live/api/privkey.pem; # then: nginx -t && nginx -s reload
Always re-test with openssl s_client or an SSL checker from outside — not just a browser. For the different problem of an expired cert, see fixing an expired SSL certificate.
Practise it
Broken chains are one of the simulator's TLS incidents. Drill them in a full incident response shift.