"unable to verify the first certificate": your server is missing the intermediate chain, not the cert

verbatim errorError: unable to verify the first certificate at TLSSocket.onConnectSecure (node:_tls_wrap:1674:34) code: 'UNABLE_TO_VERIFY_LEAF_SIGNATURE'

Problem

A renewed certificate was installed, browsers happily show the padlock, and the Node service calling the API fails:

Error: unable to verify the first certificate
    at TLSSocket.onConnectSecure (node:_tls_wrap:1674:34)
code: 'UNABLE_TO_VERIFY_LEAF_SIGNATURE'

Also seen as SSL certificate problem: unable to get local issuer certificate in curl/git. Java clients report PKIX path building failed: unable to find valid certification path.

Root cause

A certificate alone is not a chain. CAs sign your leaf with an intermediate, which the CA keeps separate from its root. Servers are supposed to send the full chain (leaf + intermediates); browsers cache intermediates from other visits, so the site "works" for most humans while every fresh client — servers, curl, mobile apps — fails verification. The renewal process (or a cert manager config that copies only cert.pem) dropped the chain file.

fix preview — first 3 of 5 lines (bash), truncated:

openssl s_client -connect api.example.com:443 -servername api.example.com </dev/null 2>/dev/null | \
  grep -E "^(depth|verify|Certificate chain)" -A1
# 0 s:CN = api.example.com
… 2 more lines in the fix

🔒 the fix — including 4 code blocks — is members-only. $1/mo unlocks everything.