Getting tlsv1 alert unknown ca:../ssl/record/rec_layer_s3.c:1528:SSL alert number 48 even though verification seems to be ok
The key line in the error log is
SSL3 alert read:fatal:unknown CA
You say the server has the root CA cert, but you have to install it there as a trusted root certificate. The way to do that is to copy it into /usr/local/share/ca-certificates, then run
update-ca-certificates
That will add it into the database of trusted root certs in /etc/ssl/certs, where openssl will find it. You'll need to do this on the client too. See man update-ca-certificates.