Capsule fetching a package for a client fails on "self signed certificate" error when contacting Satellite

Issue

• a client trying to install a package fails with Status code: 500 error from Capsule
• Capsule logs [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1131)') error when attempting to download the package from Satellite
• Satellite does not log anything
• neither attempts below helps:
  • dnfcache cleanup
  • client reregister
  • Capsule full sync
  • regenerate metadata of either repo
• in past, we exported Library content for Inter-Satellite-Sync from this connected Satellite
• the Capsule has LibraryLifecycle Environment assigned