I know some sites serve incomplete cert chains (missing the intermediate). Browsers fix this automatically, Go doesn't. have your tested a site with broken cert chain? got a url to share? Would help me pin down the issue.

Thanks!