Tried a few tests. Pi4, Pi3, Vero4 fail.
Ubuntu 20, OpenSuse work.
Looks like a issue with an outdated CA root certificate. Even if you re-install the ca certs bundle it still given an issue.
As a test I downloaded the latest cacerts.pem from the curl website and pointed to that and the connection is successful.
With the failure:
* TLSv1.3 (OUT), TLS alert, unknown CA (560):
* SSL certificate problem: unable to get local issuer certificate
Then with the latest CA cert:
wget https://curl.haxx.se/ca/cacert.pem
curl -v --cacert cacert.pem https://devstreaming-cdn.apple.com
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256
* ALPN, server accepted to use h2
* Server certificate:
* subject: CN=devstreaming-cdn.apple.com; OU=management:idms.group.665035; O=Apple Inc.; ST=California; C=US
* start date: Mar 11 21:30:01 2019 GMT
* expire date: Apr 9 21:30:01 2021 GMT
* subjectAltName: host "devstreaming-cdn.apple.com" matched cert's "devstreaming-cdn.apple.com"
* issuer: CN=Apple IST CA 8 - G1; OU=Certification Authority; O=Apple Inc.; C=US
*** SSL certificate verify ok.**
You will have to wait for the CA certs to be updated upstream by Debian.