openssl s_client shows the certificate the server actually sends
When the browser says the chain is wrong, look at the chain.
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \
| openssl x509 -noout -dates -subject -issuer-servername matters: without it a server with several certificates returns the default one, which is not the one you are debugging.
shellsecurity