Works in the browser, fails from the backend with a certificate error

• A new subdomain reports.example.com was added behind the shared reverse proxy.
• Chrome opens https://reports.example.com fine.
• The Python backend that calls it fails with SSLCertVerificationError: hostname mismatch.
• A colleague on an older Python version reports a different error: unable to get local issuer certificate.

$ openssl s_client -connect reports.example.com:443 </dev/null 2>/dev/null \
    | openssl x509 -noout -subject -ext subjectAltName
subject=CN = www.example.com
X509v3 Subject Alternative Name:
    DNS:www.example.com, DNS:example.com

$ openssl s_client -connect reports.example.com:443 -servername reports.example.com </dev/null 2>/dev/null \
    | openssl x509 -noout -subject -ext subjectAltName
subject=CN = reports.example.com
X509v3 Subject Alternative Name:
    DNS:reports.example.com

$ openssl s_client -connect reports.example.com:443 -servername reports.example.com -showcerts </dev/null 2>&1 \
    | grep -c "BEGIN CERTIFICATE"
1                                        # leaf only, no intermediate sent

$ python3 -c "import ssl; print(ssl.OPENSSL_VERSION)"
OpenSSL 3.0.13