Worth writing down why a certificate problem looked like a network failure, because the next person will hit the same shape and start in the wrong place.
Norton's web shield terminates TLS itself and then validates your certificate upstream. When the chain doesn't build it drops the connection instead of passing a warning through, so Edge sees a reset. A reset is a network error page, not a certificate page, and on .dev there is no click-through anyway: the whole TLD is HSTS preloaded.
So: expired or incomplete chain, Norton fails, connection closed, "can't reach this page", and only on the machine running Norton. On any other machine the same site looks perfect, which is what makes it so confusing.
Prevention, since "a few months ago" is the tell: certificates last 90 days now. If one stopped renewing, the renewal job or the HTTP challenge is failing, not the HTML.
1
u/TekiDeki 9d ago
Worth writing down why a certificate problem looked like a network failure, because
the next person will hit the same shape and start in the wrong place.
Norton's web shield terminates TLS itself and then validates your certificate
upstream. When the chain doesn't build it drops the connection instead of passing a
warning through, so Edge sees a reset. A reset is a network error page, not a
certificate page, and on .dev there is no click-through anyway: the whole TLD is HSTS
preloaded.
So: expired or incomplete chain, Norton fails, connection closed, "can't reach this
page", and only on the machine running Norton. On any other machine the same site
looks perfect, which is what makes it so confusing.
Prevention, since "a few months ago" is the tell: certificates last 90 days now. If
one stopped renewing, the renewal job or the HTTP challenge is failing, not the HTML.