Exit status 60 with 'SSL certificate problem: unable to get local issuer certificate' means curl completed the handshake but could not build a chain to a trusted root using the CA store it is configured with. The certificate itself may be perfectly valid. The usual causes are a corporate TLS-inspecting proxy whose root is not in the bundle, a server that fails to send its intermediate certificates, or a container image with no ca-certificates package installed.
Distinguish them. 'openssl s_client -connect host:443 -showcerts' prints the chain the server actually sends; a chain of length one against a certificate issued by an intermediate confirms a server misconfiguration. 'curl -v' names the CA file or directory in use.
Fixes in order of preference: install the missing intermediates on the server, add the proxy root to the system trust store, or point curl at a specific bundle with '--cacert' or the CURL_CA_BUNDLE environment variable. '--insecure' disables verification entirely and turns a transport-security tool into an unauthenticated one; it is acceptable for a one-off diagnosis and never in a script that handles credentials.