...
Here we can see QuoVadis Root CA 2 G3 is the Root CA for for api.ecmwf.int and can be downloaded from https://www.quovadisglobal.com/QVRepository/DownloadRootsAndCRL.aspx download-roots-crl/ and installed locally (as per the commands specified above on the specific OS).
If you have the SSL error in the last step of your request (Transferring from...), you need to install the Root CA for "stream.ecmwf.int": QuoVadis Global SSL ICA G2
...