Why Your App Fails SSL Checks That Browsers Pass — and How to Fix It

When a browser shows a green padlock but server-side tools like curl, Node.js, Python, or Go throw an SSL certificate error, the root cause is almost always a misconfigured server, not a strict client. TLS servers are required to send the full certificate chain — the leaf certificate plus all intermediate certificates — but many are deployed with only the leaf, leaving API clients unable to verify the path to a trusted root. Browsers mask this flaw by caching intermediates from previous visits and using Authority Information Access (AIA) fetching to download missing ones, which most server-side stacks deliberately avoid. The most common trigger is using Let's Encrypt's cert.pem instead of fullchain.pem, which omits the necessary intermediate certificate. Disabling SSL verification with flags like curl -k or rejectUnauthorized: false is not a fix — it silences a warning that correctly identifies a real server misconfiguration.