Authentication fails with invalid TLS certificate error on self-hosted Coder deployment (macOS)

Start by reproducing the authentication failure in Coder Desktop 0.8.4 against a self-hosted deployment with a publicly issued certificate, then inspect the macOS authentication and TLS error logs. Compare the app’s certificate evaluation with the successful OpenSSL and macOS verification results in the report. Done means authentication succeeds with the described valid certificate, with diagnostics identifying the cause; the issue does not name source files or tests.

Coder Desktop version: 0.8.4
Deployment: Self-hosted Coder on Linux
Platform: macOS

Description

I'm unable to authenticate with my self-hosted Coder deployment using Coder Desktop for macOS.

The application displays the following error:

Could not authenticate with Coder deployment:
The certificate for this server is invalid. You might be connecting to a server that is pretending to be “[my Coder deployment hostname]” which could put your confidential information at risk.

The deployment uses a publicly issued Let's Encrypt certificate. I've investigated the TLS configuration on both the server and macOS, but haven't been able to identify the cause.

Diagnostics

1. OpenSSL certificate verification

Running openssl s_client against the deployment:

openssl s_client \
  -connect YOUR_CODER_HOST:443 \
  -servername YOUR_CODER_HOST \
  -showcerts \
  -verify_return_error </dev/null

OpenSSL successfully verifies the certificate chain:

Verify return code: 0 (ok)

The server presents three certificates.

2. Certificate details

• Subject: My Coder deployment hostname
• Issuer: Let's Encrypt YR2
• Validity: November 5, 2026 – February 3, 2027
• Key: RSA 4096-bit
• Signature: SHA-256 with RSA

3. macOS Keychain

I imported the leaf certificate into the System Keychain and explicitly set its trust policy to Always Trust.

This did not resolve the issue.

4. macOS certificate verification

Running:

security verify-cert -v https://YOUR_CODER_HOST

Returns:

...certificate verification successful.

The trust evaluation reports:

TrustResultValue = 1

It also reports:

Certificate Transparency (CT) status: not verified
Unable to find at least 2 signed certificate timestamps (SCTs) from approved logs

5. Application logs

Coder Desktop's macOS unified logs show normal VPN system extension initialization and Mutagen daemon startup/shutdown. However, the captured logs did not contain the actual authentication failure or a corresponding TLS error.

Timestamp                       Thread     Type        Activity             PID    TTL  
2026-11-06 19:03:51.610937+0500 0x3d06b8   Info        0x0                  32942  0    com.coder.Coder-Desktop.Helper: [com.coder.Coder-Desktop:system-wake-observer] system woke from sleep
2026-11-06 19:08:03.760032+0500 0x3d07a6   Info        0x0                  32991  0    Coder Desktop: (VPNLib) [com.coder.Coder-Desktop:mutagen] stopping mutagen daemon
2026-11-06 19:08:03.762378+0500 0x3d07a6   Info        0x0                  32991  0    Coder Desktop: (VPNLib) [com.coder.Coder-Desktop:mutagen] mutagen daemon state set: Stopped
2026-11-06 19:08:18.362918+0500 0x3dab47   Info        0x0                  47665  0    Coder Desktop: [com.coder.Coder-Desktop:vpn-installer] SystemExtensionDelegate initialized
2026-11-06 19:08:18.362919+0500 0x3dab47   Info        0x0                  47665  0    Coder Desktop: [com.coder.Coder-Desktop:vpn-installer] activating SystemExtension
2026-11-06 19:08:18.363801+0500 0x3dab47   Info        0x0                  47665  0    Coder Desktop: [com.coder.Coder-Desktop:vpn-installer] submitted SystemExtension request with bundleID: <private>
2026-11-06 19:08:18.560624+0500 0x3dab47   Info        0x0                  47665  0    Coder Desktop: (VPNLib) [com.coder.Coder-Desktop:mutagen] Successfully connected to mutagen daemon, socket: /Users/[REDACTED_USERNAME]/Library/Application Support/Coder Desktop/Mutagen/daemon/daemon.sock
2026-11-06 19:08:18.571456+0500 0x3dab47   Info        0x0                  47665  0    Coder Desktop: (VPNLib) [com.coder.Coder-Desktop:mutagen] stopping mutagen daemon
2026-11-06 19:08:18.571478+0500 0x3dab47   Info        0x0                  47665  0    Coder Desktop: (VPNLib) [com.coder.Coder-Desktop:mutagen] mutagen daemon state set: Stopped
2026-11-06 19:08:18.577621+0500 0x3dab47   Info        0x0                  47665  0    Coder Desktop: (VPNLib) [com.coder.Coder-Desktop:mutagen] starting mutagen daemon
2026-11-06 19:08:18.579644+0500 0x3dab47   Info        0x0                  47665  0    Coder Desktop: (VPNLib) [com.coder.Coder-Desktop:mutagen] setting mutagen data directory: /Users/[REDACTED_USERNAME]/Library/Application Support/Coder Desktop/Mutagen
2026-11-06 19:08:18.585370+0500 0x3dab47   Info        0x0                  47665  0    Coder Desktop: [com.coder.Coder-Desktop:vpn-installer] SystemExtension installed
2026-11-06 19:08:18.585440+0500 0x3dab47   Info        0x0                  47665  0    Coder Desktop: [com.coder.Coder-Desktop:vpn] system extension state: NE SystemExtension is installed
2026-11-06 19:08:18.665866+0500 0x3dab47   Info        0x0                  47665  0    Coder Desktop: (VPNLib) [com.coder.Coder-Desktop:mutagen] 2026-11-06 19:08:18.661966 [I] [forward] Looking for existing sessions
2026-11-06 19:08:18.666116+0500 0x3dab47   Info        0x0                  47665  0    Coder Desktop: (VPNLib) [com.coder.Coder-Desktop:mutagen] 2026-11-06 19:08:18.662276 [I] [forward] Session manager initialized
2026-11-06 19:08:18.666216+0500 0x3dab47   Info        0x0                  47665  0    Coder Desktop: (VPNLib) [com.coder.Coder-Desktop:mutagen] 2026-11-06 19:08:18.662297 [I] [sync] Looking for existing sessions
2026-11-06 19:08:18.666308+0500 0x3dab47   Info        0x0                  47665  0    Coder Desktop: (VPNLib) [com.coder.Coder-Desktop:mutagen] 2026-11-06 19:08:18.662343 [I] [sync] Session manager initialized
2026-11-06 19:08:19.218089+0500 0x3dab47   Info        0x0                  47665  0    Coder Desktop: (VPNLib) [com.coder.Coder-Desktop:mutagen] mutagen daemon state set: Running
2026-11-06 19:08:19.218663+0500 0x3dab47   Info        0x0                  47665  0    Coder Desktop: (VPNLib) [com.coder.Coder-Desktop:mutagen] mutagen daemon started, pid:
 47702
2026-11-06 19:08:19.222146+0500 0x3dab47   Info        0x0                  47665  0    Coder Desktop: (VPNLib) [com.coder.Coder-Desktop:mutagen] No sync sessions found on startup, stopping daemon
2026-11-06 19:08:19.223140+0500 0x3dab47   Info        0x0                  47665  0    Coder Desktop: (VPNLib) [com.coder.Coder-Desktop:mutagen] stopping mutagen daemon
2026-11-06 19:08:19.223186+0500 0x3dab47   Info        0x0                  47665  0    Coder Desktop: (VPNLib) [com.coder.Coder-Desktop:mutagen] mutagen daemon state set: Stopped
2026-11-06 19:08:19.225567+0500 0x3dab47   Info        0x0                  47665  0    Coder Desktop: (VPNLib) [com.coder.Coder-Desktop:mutagen] 2026-11-06 19:08:19.220353 [I] Daemon termination requested
2026-11-06 19:08:19.225627+0500 0x3dab47   Info        0x0                  47665  0    Coder Desktop: (VPNLib) [com.coder.Coder-Desktop:mutagen] mutagen daemon stopped
2026-11-06 19:08:19.225743+0500 0x3dab47   Info        0x0                  47665  0    Coder Desktop: (VPNLib) [com.coder.Coder-Desktop:mutagen] 2026-11-06 19:08:19.220786 [I] [sync] Shutting down
2026-11-06 19:08:19.225932+0500 0x3dab47   Info        0x0                  47665  0    Coder Desktop: (VPNLib) [com.coder.Coder-Desktop:mutagen] Daemon stopped and gRPC connection closed
2026-11-06 19:08:19.225971+0500 0x3dab47   Info        0x0                  47665  0    Coder Desktop: (VPNLib) [com.coder.Coder-Desktop:mutagen] 2026-11-06 19:08:19.220811 [I] [forward] Shutting down
2026-11-06 19:08:19.226073+0500 0x3dab47   Info        0x0                  47665  0    Coder Desktop: (VPNLib) [com.coder.Coder-Desktop:mutagen] standard error stream closed

Expected behavior

Coder Desktop should authenticate successfully with a self-hosted Coder deployment using a valid, publicly trusted Let's Encrypt certificate.

Actual behavior

Authentication fails with a certificate-invalid warning, even though OpenSSL successfully verifies the server certificate and macOS certificate verification succeeds with the manually trusted leaf certificate.

---

I'm happy to provide additional diagnostics, including the complete certificate chain, macOS version, server version, and application logs.