Please read my code. I've provided the CA certificate; this should work because I've downloaded the certificate manually and feed it to Python.

openssl command line tool works. gnutls-cli works too. wget (with openssl) works too. curl (with openssl) fails like Python but I don't understand why.

I've successfully done things like this before, but now I encounter a site that Python can't verify with the correct CA certificate (that other tools accept).