Browser says fine, curl says unable to get local issuer

Twice this month now. Site loads with a padlock in every browser, while curl and anything on Python fail with certificate verify errors: curl: (60) SSL certificate problem: unable to get local issuer certificate The server isn't sending the intermediate. Browsers cope by fetching it or having it cached. Everything else fails. With certbot, ssl_certificate has to be fullchain.pem and not cert.pem. openssl s_client -connect example.com:443 -servername example.com -showcerts If you only see one certificate block, that's it.