Nginx TLSv1.2 (OUT), TLS alert, unknown CA (560)

server {
        listen          111.11.111.11:80;
        listen          [::]:80;

        server_name     seite1.de www.seite1.de;

        return 301 https://seite1.de$request_uri;
}

server {
        listen          111.11.111.11:443 ssl;
        listen          [::]:443 ssl;

        server_name     seite1.de www.seite1.de;

        ssl_certificate /etc/nginx/ssl-certs/2021_wc.seite1_de.crt;
        ssl_trusted_certificate /etc/nginx/ssl-certs/2021_SectigoRSAExtendedValidationSecureServerCA.crt;
        ssl_certificate_key /etc/nginx/ssl-certs/2021_wc.seite1_de.key;

        root /srv/www/htdocs/shopware_seite1_de/public;
        index index.php index.html;

        allow 127.0.0.1;
        allow 222.11.111.11;
        allow 90.187.21.233;
        allow 111.11.111.11;
        allow 111.11.111.22;
        deny all;


        location /recovery/install {
                allow 222.11.111.11;
                allow 111.11.111.11;
                allow 111.11.111.22;
                deny all;
                index index.php;
                try_files $uri /recovery/install/index.php$is_args$args;
        }

        location /recovery/update/ {
                allow 222.11.111.11;
                allow 111.11.111.11;
                allow 111.11.111.22;
                deny all;
                location /recovery/update/assets {
                }
                if (!-e $request_filename){
                        rewrite . /recovery/update/index.php last;
                }
        }

        location / {
                try_files $uri /index.php$is_args$args;
        }

        location ~ \.php$ {
                fastcgi_split_path_info ^(.+\.php)(/.+)$;
                include fastcgi.conf;
                fastcgi_param HTTP_PROXY "";  
                fastcgi_buffers 8 16k;
                fastcgi_buffer_size 32k;
                client_max_body_size 24M;
                client_body_buffer_size 128k;
                fastcgi_pass localhost:9000;
                http2_push_preload on;
        }

        location /admin_status {
                stub_status on;
                allow ::1;
                allow 222.11.111.11/32;
                deny all;
        }

        access_log /srv/www/log/shopware_seite1_de-access.log;
        error_log /srv/www/log/shopware_seite1_de-error.log;

}

curl -vvv https://seite1.de
*   Trying 111.11.111.11:443...
* TCP_NODELAY set
* Connected to seite1.de (111.11.111.11) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (OUT), TLS alert, unknown CA (560):
* SSL certificate problem: unable to get local issuer certificate
* Closing connection 0
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.