I'm getting certificate errors. This is a giant red flag to me.
Use Qualys [1] to test the domain in question to link here or use the testssl.sh [2] code only depends on openssl and bash to test from your machine. If one of the many self hosted nodes, see if you can find a way to reach out to them and kindly suggest they set up certbot or a cron job to renew their certs.
Joinpeertube.org looks good to me [3] so I assume you find a self-hosted node that needs some attention.
If someone here knows of a way to query a list of all the self-hosted domains joined into peertube perhaps we could run testssl.sh against all of them to generate reports. I am not opposed to doing this if someone knows how I can get a list of all the domains using curl.
[1] - https://www.ssllabs.com/ssltest/
[2] - https://github.com/drwetter/testssl.sh
[3] - https://www.ssllabs.com/ssltest/analyze.html?d=joinpeertube....
Clicking on the HN link, as a user how would I know this is to be expected? or that it's one random node?
If you are experiencing issues on joinpeertube.org then it may be worth running an OS update and ensuring you also have the latest version of your browser to rule out CA certificate store issues. CA stores are periodically updated and LetsEncrypt did go through a change that will eventually invalidate its older signing keys and intermediate certificates. This would only impact people that have stagnant operating systems or browsers unless one is being routed through an outdated MitM Man-in-the-Middle HTTPS proxy.
We may be able to rule out MitM with openssl, see if the fingerprint is the same for you.
openssl s_client -servername joinpeertube.com -connect joinpeertube.com:443 < /dev/null 2>/dev/null | openssl x509 -fingerprint -noout -in /dev/stdin
SHA1 Fingerprint=C0:4E:F2:F6:EA:2B:72:C5:84:E0:73:2C:2C:2B:BB:FB:A1:34:C8:20It's showing as some kind of cicso cert valid for a couple of days.
There's no interception on this network. Other let's encrypt certs work just fine.