Can you please attach a chrome://net-export log (as detailed at https://www.chromium.org/for-testers/providing-network-details ).

Is this a publicly accessible site, or a private Enterprise site? If you can attach the certificate (if Enterprise) or point to which site on https://crt.sh/ (if publicly accessible), that'd also elp.

Finally, what version of Mozilla NSS are you running (for Ubuntu, this is the libnss3 package)

(-8101 appears to be SEC_ERROR_INADEQUATE_CERT_TYPE.)

net export

Deleted: chrome-net-export-log.json 656 KB

chrome-net-export-log.json 656 KB View Download

cert

Deleted: example.crt 862 bytes

example.crt 862 bytes Download

ii  libnss3:amd64                              2:3.28.4-0ubuntu0.16.04.3                    amd64        Network Security Service libraries

Thank you for providing more feedback. Adding the requester to the cc list.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

I include this in my self signed cert:
KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature
ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth}

Could the ExtKeyUsage be causing the issue?

Was there something in particular that directed you to include keyEncipherment?

As you're using an ECDSA key, that's not the correct key usage (see https://tools.ietf.org/html/rfc5480#section-3 ). Just using KeyUsageDigitalSignature is correct.

I suspect it may have been a carryover from when you previously used an RSA key, which does need keyEncipherment for some TLS ciphersuites.

Does that resolve your issue?

Removing the CA flag and the KeyUsageCertSign usage fixed it.
Strange that firefox, safari, chrome etc all work on mac, and on ubuntu.  Only chrome didn't work though.  That still seems strange to me

Thank you for providing more feedback. Adding the requester to the cc list.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

In this case, it's due to NSS being stricter than other platforms cryptographic libraries. We're working to ensure that we're consistently strict on all platforms, but it was definitely an invalid certificate. Microsoft and Apple are just more forgiving of those (than they should be / than others are)