Report post #2 in Browser says fine, curl says unable to get local issuer

So that's what that was. I'd "fixed" this in a script with verify=False last year. Going to go and undo that now.