```
$ fossil clone flint.fossil
Unable to verify SSL cert from
  subject:   CN =
  issuer:    C = US, O = Let's Encrypt, CN = R11
  notBefore: 2024-10-07 03:41:38 UTC
  notAfter:  2025-01-05 03:41:37 UTC
  sha256:
```

```
$ curl -v
* Host was resolved.
* IPv6: 2607:f1c0:800:8902:68e8:7a3f:2812:3fc0
* IPv4:
*   Trying [2607:f1c0:800:8902:68e8:7a3f:2812:3fc0]:443...
* Connected to (2607:f1c0:800:8902:68e8:7a3f:2812:3fc0) port 443
* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (OUT), TLS alert, unknown CA (560):
* OpenSSL/3.0.14: error:16000069:STORE routines::unregistered scheme
* closing connection #0
curl: (35) OpenSSL/3.0.14: error:16000069:STORE routines::unregistered scheme
```

I think the problem may be that Let's Encrypt now selects a random intermediate issuer on each renewal, so you must have the web server update this every time instead of using a hard-coded chain?