The windows certificates are fine because the site opens fine in Edge.
I found that gRPC uses
%PYTHON_HOME%\lib\site-packages\grpc_cython_credentials\roots.pem for its certificates and if I add the one I needed to the bottom of that, it made it work.
I didn't try, but I think if I were to create a file and set that file's path in
GRPC_DEFAULT_SSL_ROOTS_FILE_PATH environment variable, that would work too.