It Works in My Browser: Debugging TLS Certificate Errors in Chains, SANs and Expiry
Your browser shows a padlock and your partner's API client throws "unable to get local issuer certificate". Both are correct. A practical guide to the four things a TLS client actually checks, and to renewal automation that reaches the running server instead of just the disk.