An incomplete certificate chain that browsers hide

curl failed with unable to get local issuer certificate while the site opened fine in a browser. Usually that means the server sends only the leaf certificate.

Browsers cache intermediates and can fetch them via AIA, so they paper over it. Command-line clients, Java and many embedded devices cannot.

openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null | grep -E '^ *[0-9] s:'

One certificate means the chain is short. In nginx, ssl_certificate must point at fullchain.pem, not cert.pem. The names look alike, nothing breaks in a browser, and the problem only shows up on the client you did not test.