Can you please provide details about your 'puma' console log? Given that it mentions OpenSSL, what version of Puma, MiniSSL, and OpenSSL are you running?

Going by the OpenSSL error, it seems that OpenSSL complains your server has no ECDH curves in common with Chrome (we offer X25519, P-256, and P-384). In the NetLog, your TLS 1.2 connection is negotiating the obsolete TLS_RSA_WITH_AES_256_GCM_SHA384, rather than TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384.

Thus it looks like your server is not configured to use a supported ECDH curve. This is recoverable in TLS 1.2 (at the cost of using less secure ciphers), but mandatory in TLS 1.3.

OpenSSL's defaults should include all of X25519, P-256, and P-384 (X25519 is recommended), so I'm guessing you or some other software you're using (Puma?) has disabled them for some reason.

Thank you for providing more feedback. Adding the requester to the cc list.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

I suspected that maybe creating the self-signed certificate with `OpenSSL 0.9.8zh 14 Jan 2016` (which is the default for macOS 10.12) may have been the issue, however, after setting up a new dev environment in macOS 10.14, and generating a new certificate with `LibreSSL 2.6.4` (which is the default for macOS 10.14), I sill am running into the same issue. 

I've also added an issue in the puma repo: https://github.com/puma/puma/issues/1670

Looks like the issue is this line here:
https://github.com/puma/puma/blob/72882f2319e65b371e1458069723279b3196a220/ext/puma_http11/mini_ssl.c#L193

P-521 is not a very common curve. It's not supported by Chrome or Edge. The immediate fix would be to use NID_X9_62_prime256v1 (P-256) instead, which is where most hardening work is focused.

But OpenSSL also has a fine set of defaults in 1.1.0, and an API to negotiate multiple curves. 1.0.2's defaults are a little large, but also fine. Thus, something like this may be better:

#if OPENSSL_VERSION_NUMBER < 0x10002000L
  // Remove this case if OpenSSL 1.0.1 (now EOL) support is no
  // longer needed.
  EC_KEY *ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
  if (ecdh) {
    SSL_CTX_set_tmp_ecdh(ctx, ecdh);
    EC_KEY_free(ecdh);
  }
#elif OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
  // Prior to OpenSSL 1.1.0, servers must manually enable server-side ECDH
  // negotiation.
  SSL_CTX_set_ecdh_auto(ctx, 1);
#endif

As per comment #0, This issue seems to be related to network specific issue.Hence, removing Needs-Bisect label and adding TE-NeedsTriageHelp as this is already being investigated.

Thanks..!

Closing this. It's a problem with the server software.