found an alternate solution (for our CWP-Tomcat mode of installation)
modify supercontainer.php
installed in C:Program Files (x86)FileMakerFileMaker ServerWeb Publishingpublishing-enginephp
add this to the _createCurl function:
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
this option tells curl to bypass attempts to validate the SSL cert on the webserver which serves SC
still, the better solution would be to find a way to properly introduce the CA chain for our webserver's SSL certificate into the appropriate certificate store but I can't figure out where that lives.
it might be a keystore that is part of PHP since its the PHP Curl library that is negotiating the SSL connection.