More debugging information when verification fails

Yeah, but I think from the end-user perspective, saying "some servers couldn't connect but some could" is pretty useful, and if the primary fails but secondary succeed it doesn't tell the user anything like that. Whether a server is "primary" or "secondary" is just how Let's Encrypt organizes them, but really from an end-user perspective the difference should be immaterial. Better messaging to make clear whether "no server could connect" or "some servers could connect and some couldn't" would probably be helpful, rather than just the "secret code" here of "is the word secondary in the message" being somewhat helpful for one-way-around.

I've seen several cases lately where it looks like primary failed but at least some secondary succeeded (or at least they see some connections working in their logs without the word "secondary" being in the error message; there's the OP's here, one from last weekend, and this one from yesterday). I don't know if the connection at Let's Encrypt's main datacenter has gotten less reliable or if it's just a coincidence that I happened to notice these, but if they're going to be trying all the connections at once anyway, it seems that reporting when a partial success happens might be useful for those debugging even when one of the failures is the primary server.

4 Likes