It’s inside the container. You can
./launcher enter app
To get in it. You can poke around and find the command that tries to get the certificate. I do it infrequently enough that I can never remember what it is. You can likely search here and find it.
My best guess is still a dns issue, but it sounds like you’ve done things right.