SSL Certificate Problem: Unable to Get Local Issuer Certificate

It works in your browser and fails in curl, Node, or Python with "unable to get local issuer certificate." That almost always means your server is sending an incomplete certificate chain — and the browser is hiding it. Why, the causes in the order they bite, and how to read the chain your server actually serves.