This isn’t directly a Let’s Encrypt issue, but I’m hoping this audience can help me resolve it as it’s obviously deeply related to SSL certificates. (If this is deemed too off-topic, please accept my apologies and let me know.)
On macOS (10.14.6), using Safari (13.1), Safari is telling me that it “can’t establish a secure connection to the server”. But only sometimes:
The majority of sites work fine.
It works fine after a reboot.
Last time it went 27 hours after the reboot before re-occurring. ¯\_(ツ)_/¯
That last site is actually hosted at https://bumman2020.netlify.com. When accessed via that URL, the certificate is DigiCert SHA2 Secure Server CA and works A-OK.
Firefox always works. So how does its certificate behaviour differ from Safari? Does it manage its own, and not use the system keychain?
Brave fails but in a really weird way. It tells me that the cert is invalid (NET::ERR_CERT_INVALID) but when I inspect the certificates they’re all valid! Here’s an example of that, using another certificate that fails. (https://theage.com.au is a large newspaper – this site works fine in Firefox.)
Yes, I think Firefox uses its own root store unless you configure it not to.
ERR_CERT_INVALID is a catch-all, I think. Usually the error code is more specific, and you can click on the error code for more information about the certificate. But I don't think it'll help in this case.
I don't have a solution for you other than to tell you that my sister experienced a similar thing on macOS some weeks ago. Except hers also had problems with some certificates from Amazon CA, until she rebooted her laptop.
e: One idea - on that screenshot, you are showing that the leaf certificate is valid. If you select the intermediate, or the root, do they also have the same "This certificate is valid" text?
Stranger still: if I open a private window in Safari and browse to one of the broken sites, Safari warns me that “this connection is not private” and gives me the chance to “visit this website” as long as I authenticate to confirm that it is safe to do so.
When in a non-private window, I am not given this option. It’s just a flat-out “can’t establish a secure connection”.
If you're referring to your bumman site, it'd be because it's setup with an HSTS header. Browsers will omit the option to bypass the warning screen for HSTS-protected sites (that it's seen before, or are in the HSTS preload list).
When you browse the site in private mode, the HSTS cache isn't used, so the browser lets you through.
In that thread, the issue seemed to be that macOS didn't recognize a newer Certificate Transparency log that should have been supported since early December.
The OP said yesterday that it was fixed after installing a recent update.
If it works for OP after a reboot, it might be what made it “work” for me after applying the the update (since it rebooted). I’ll have to wait and see, I guess.
OP, you say all updates are installed, does that also imply the 002 security update from end of March?
OK, the issue is back on my Mac now, so it seems we have the same issue, and that it’s solved temporarily by rebooting. The latest security update (https://support.apple.com/en-gb/HT211100) did not solve it.
@jen729w, are you by any chance using Little Snitch?
I do use Little Snitch, yes. Always have, config hasn’t changed in however long. These servers ping just fine and I’ve tried this with the network filter off, no change.
I recall a recent security update, yes. They pop up I do them as soon as I see them.
Have you and @jockek tried to see if those websites work in safe mode? (e.g. disabled all extensions and other potential softwares). Other networks? Have you submit any reports to Apple Support?
The problem with safe mode is that the issue is fine immediately after a reboot. I’d need to operate in safe mode for ~24h until it occurs, which I can’t afford to do. This is my main work machine.
I have tried other networks, yes. The network is not the issue.
