It looks like the server is closing connection for some reason, but I can't tell why from https://www.ssllabs.com/ssltest/analyze.html?d=www.palmap.org. Removing security labels and moving over to networking queue.

Poking around with the BoringSSL command-line tool, they seem to be intolerant to our status_request (OCSP stapling) extension for some reason. That's odd since Firefox also sends it. Poking further...

There appears to be some cipher-specific bug with this server. The server supports the following ciphers, with a server-enforced preference order:

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
TLS_RSA_WITH_AES_256_GCM_SHA384
TLS_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_AES_256_CBC_SHA256
TLS_RSA_WITH_AES_128_CBC_SHA256
TLS_RSA_WITH_AES_256_CBC_SHA
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA

Of these the earliest cipher Firefox supports is TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, so the server selects that. If it selects that, the server handles OCSP stapling just fine.

However, Chrome additionally supports TLS_RSA_WITH_AES_256_GCM_SHA384, which the server is configured to prefer. If it selects TLS_RSA_WITH_AES_256_GCM_SHA384, the server breaks on OCSP stapling. Toying around, the other static RSA (TLS_RSA_WITH_*) ciphers have the same failure mode.

This is a bug in the server software. (Incidentally, neither of the two ciphers is ideal. It should be using TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 or TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384.) The server claims to be Microsoft-IIS/8.5, though whether there is something else fronting TLS, I'm not sure. The preference order does look like other IIS servers I've seen, but if IIS were broadly incompatible with Chrome, I imagine someone would have noticed it and fixed it by now.

Are you the maintainer of this site? If so, what is this server running? Assuming this is IIS, could you please check that you are up-to-date on Windows updates?

[hmyounan]:  Could you please response to comment #3?

Reporter, could you please respond to the question at the end of comment #3?

(The server's cipher preferences seem to have changed and I can't reproduce the issue anymore, so I suspect the site may have taken the advice in comment #3.)