Browsers load the shop after a certificate renewal, but API clients fail TLS

The certificate for shop.example.com (WEB1, nginx, 203.0.113.80) was renewed over the weekend with a new issuing CA. On Monday, browser users report no problems. But the partner's order integration, written in Java, fails with PKIX path building failed; the monitoring check, which uses curl, alerts with SSL certificate problem: unable to get local issuer certificate; and a Python script used by the finance team fails with CERTIFICATE_VERIFY_FAILED.