Random failures: "unable to get local issuer certificate"

Hi all,

I’m running the download
	curl https://sh.rustup.rs -sSf | sh
this works fine, but the rust installer it calls fails on random hosts
and jails with

error sending request \
for url (https://static.rust-lang.org/dist/channel-rust-stable.toml.sha256): \
error trying to connect: error:1416F086:SSL \
routines:tls_process_server_certificate:certificate \
verify failed:ssl/statem/statem_clnt.c:1915: \
(unable to get local issuer certificate)

All tested systems/jails are running 12.2p7 and habe identical cert stores,
kept up-to-date with freebsd-update.
OpenSSL 1.1.1h-freebsd from base.

Which knobs are influencing local issuer list?
Where can I dig to resolve this issue?

Any help appreciated,
Axel
---
PGP-Key: CDE74120  ☀  computing @ chaos claudius