Firefox is using its own CA database which includes the necessary Startcom intermediate certificate; OpenSSL uses /etc/ssl instead which does not have that intermediate certificate. But you should fix this at the server side, not the client side.
SSL certificate validation requires each certificate in the chain be validated. The chain starts at the root, ends at the node certificate, and may include zero or more intermediate certificates.
The client software must have a list of trusted roots. A root is signed by itself, and is trusted by virtue of the software vendor including that certificate in its trusted roots store. In the case of Firefox, that's (I believe) cert8.db. In the case of OpenSSL, it uses the /etc/ssl hierarchy.
The client software may include intermediate certs in its store, as well. However, it's not required to. It appears that Firefox has done so for Startcom, but that Ubuntu's /etc/ssl configuration tree does not.
For this reason, it is best practices for servers using node certificates signed with an intermediate cert to include all intermediate certs when sending their certificate to any client that connects.
To directly answer your question, putting the intermediate into /etc/ssl will fix the problem - for you. Not for anyone else browsing your site. In order to properly fix it, you should add the intermediate certificate to the chain that the server hands out. For example, with Apache, see the SSLCertificateChainFile directive - DigiCert has a good walkthrough, and StartCom also has instructions.
@DanFromGermany asks, in the comments, if I can give a reference for:
best practices for servers using node certificates signed with an
intermediate cert to include all intermediate certs
In fact, to call that "best practices" is not strictly true - it's a requirement. According to RFC 5246 (TLS 1.2):
[The certificate_list] is a sequence (chain) of certificates. The
sender's certificate MUST come first in the list. Each following
certificate MUST directly certify the one preceding it. Because
certificate validation requires that root keys be distributed
independently, the self-signed certificate that specifies the root
certificate authority MAY be omitted from the chain, under the
assumption that the remote end must already possess it in order to
validate it in any case.
By inference - each certificate in the chain must directly certify the one preceding it, and only the root certificate authority is optional ("MAY be omitted"), then all intermediate certs are required.
So it's not strictly true to say that including all intermediates is best practices - it would be fairer to say that not including all intermediates is worst practices, but happens, because people are lazy, and because it works out enough of the time.