Roon 2.71 on macOS 26.5.2 faces SSL connection issue during login loop (ref#QSYNWV)

Support
1

What is the operating system of your Roon Server host machine?

· MacOS

What kind of device are you using to perform the login?

· Mac

Where are you trying to login?

· I can't log into Roon

Have you been redirected to [https://account.roon.app](https://account.roon.app) (the Roon login page) in your browser?

· Yes

Please try clearing the browser cache and cookies for the [l](https://account.roon.app/)ogin page where you have been redirected

· No, the issue remains the same

Content / Popup Blockers

· No, the issue remains the same

Temporarily try to use a different browser

· No, the issue remains the same

Please try to restart your Roon Server by closing the Roon Server app in the taskbar (MacOS), task manager (Windows) or rebooting your Roon Server machine.

· No, the issue remains the same

Different device

· I cannot switch to a different device

Are you still facing the issue on the different device

· No, the issue remains the same

Record the timestamp

· Info: Local time is 26/08/2026 09:50:34, UTC time is 26/08/2026 08:50:34

Describe the issue

Roon 2.71 build 1683 login loop on macOS 26.5.2

I am installing Roon on an M1 Mac mini and configuring the same Mac as Roon Server.

Browser authentication succeeds and returns an authorisation code to the Roon application through roon://login?code=....

Roon Server then fails when exchanging that code for an account token:

GET https://go.roonlabs.com/Roon/account-token?...

The server log reports:

The SSL connection could not be established

followed by:

[accounts - LoginSSOConfirm] failed to login

The same SSL failure occurs for multiple Roon services, including updates.roonlabs.com, devicedb.roonlabs.net, device-map.roonlabs.net, push-manager.roonlabs.net and roonmobile.roonlabs.net.

Troubleshooting completed:

confirmed credentials work through the Roon account website;
tested Safari and Firefox;
deleted and recreated ~/Library/Roon and ~/Library/RoonServer;
tested home broadband and an iPhone hotspot;
confirmed correct date and time;
confirmed macOS curl successfully negotiates TLS 1.3 and validates certificates for the same Roon endpoints;
confirmed /Applications/Roon.app is correctly signed by Roon Labs LLC and accepted by Gatekeeper as a Notarized Developer ID application.

macOS: 26.5.2 public release
Hardware: M1 Mac mini
Roon: 2.71 build 1683 production

Logs attached.

Describe your network setup

Wessex Internet FTTP, Nokia Beacon 6 Router with Ethernet connection to Mac Mini

2

Hello @sjwellington

Thanks for a genuinely thorough report.

You confirmed curl negotiates TLS 1.3 and validates certificates to the same Roon endpoints from the same Mac, and you saw the same failure on both your broadband and an iPhone hotspot. That excludes your network, your router, the certificates and our servers. What is left is something specific to the Roon process’s TLS on that machine.

That shape almost always means something is intercepting or restricting network traffic per application, or the runtime cannot read the system trust store.

Four things would identify it.

First, please run this and tell us the output:

systemextensionsctl list
scutil --proxy

The first lists any network extensions, which is how per-application filtering is implemented on modern macOS. The second shows whether a proxy is configured.

Second, please tell us what security, VPN or network software is installed. Specifically Little Snitch, LuLu, ESET, Sophos, Norton, Cloudflare WARP, Tailscale, NextDNS or anything similar. We have seen Cloudflare WARP in particular cause exactly this kind of per-process failure on M1 Macs.

Third, please check System Settings, then General, then Device Management, and tell us whether any configuration profiles are installed. A profile can install a proxy or a root certificate that affects some applications and not others.

Fourth, from the server log, please send the full error block around The SSL connection could not be established, including the lines directly beneath it. That message is a wrapper, and the inner exception underneath it names the actual cause. That is the single most useful thing you can give us.

One quick test while you are there. Please try quitting Roon entirely, then temporarily disabling any security or VPN software you find, and starting Roon again. If login succeeds, we have the culprit and you can then work out how to allow Roon through rather than leaving it off.

3

Hi @Vadim

  1. Last login: Wed Aug 26 14:45:33 on console
    seanwellington@Seans-Mac-mini-2 ~ % systemextensionsctl list
    1 extension(s)
    — com.apple.system_extension.endpoint_security (Go to ‘System Settings > General > Login Items & Extensions > Endpoint Security Extensions’ to modify these system extension(s))
    enabled active teamID bundleID (version) name [state]
    • GT8P3H7SPW com.mcafee.CMF.networkextension (10.7.6/1) McAfee Network Extension [activated enabled]
      seanwellington@Seans-Mac-mini-2 ~ % scutil --proxy
      {
      ExceptionsList : {
      0 : *.local
      1 : 169.254/16
      }
      FTPPassive : 1
      }
      seanwellington@Seans-Mac-mini-2 ~ %

  1. I have the native Apple firewall enabled and McAfee LiveSafe. I’ve tried temporarily disabling Real-time Scanning and Firewall but that doesn’t help.

  2. None

  3. The SSL connection could not be established, see inner exception.
    08/26 09:49:26 Warn: [orbit] init failed due to Invalid Type: 10, reiniting
    08/26 09:49:26 Trace: [realtime] Updated clock skew to 00:00:00.0409860 (40.986ms)
    08/26 09:49:26 Trace: [ipaddresses] enumerating addresses
    08/26 09:49:26 Trace: [ipaddresses] FOUND lo0 127.0.0.1
    08/26 09:49:26 Trace: [ipaddresses] SKIPPED gif0: no ipv4
    08/26 09:49:26 Trace: [ipaddresses] SKIPPED stf0: no ipv4
    08/26 09:49:26 Trace: [ipaddresses] SKIPPED anpi0: no ipv4
    08/26 09:49:26 Trace: [ipaddresses] SKIPPED anpi1: no ipv4
    08/26 09:49:26 Trace: [ipaddresses] FOUND en0 192.168.28.32
    08/26 09:49:26 Trace: [ipaddresses] SKIPPED en4: no ipv4
    08/26 09:49:26 Trace: [ipaddresses] SKIPPED en5: no ipv4
    08/26 09:49:26 Trace: [ipaddresses] SKIPPED en2: no ipv4
    08/26 09:49:26 Trace: [ipaddresses] SKIPPED en3: no ipv4
    08/26 09:49:26 Trace: [ipaddresses] SKIPPED bridge0: no ipv4
    08/26 09:49:26 Trace: [ipaddresses] SKIPPED ap1: no ipv4
    08/26 09:49:26 Trace: [ipaddresses] FOUND en1 192.168.28.59
    08/26 09:49:26 Trace: [ipaddresses] SKIPPED awdl0: no ipv4
    08/26 09:49:26 Trace: [ipaddresses] SKIPPED llw0: no ipv4
    08/26 09:49:26 Trace: [ipaddresses] SKIPPED utun0: no ipv4
    08/26 09:49:26 Trace: [ipaddresses] SKIPPED utun1: no ipv4
    08/26 09:49:26 Trace: [ipaddresses] SKIPPED utun2: no ipv4
    08/26 09:49:26 Trace: [ipaddresses] SKIPPED utun3: no ipv4
    08/26 09:49:26 Trace: [ipaddresses] SKIPPED utun4: no ipv4
    08/26 09:49:26 Trace: [ipaddresses] SKIPPED utun5: no ipv4

I tried disabling (but not uninstalling) McAfee and restarting Roon that doesn’t help either..

4

Hello @sjwellington

That output gives us the suspect.

com.mcafee.CMF.networkextension (10.7.6/1) McAfee Network Extension [activated enabled]

The extension is still active. Turning off Real-time Scanning and the firewall in McAfee’s own interface does not remove it from the network path, so that test did not clear it. This is exactly the kind of component that breaks TLS for one application while leaving curl working.

No proxy and no configuration profiles, so both are ruled out.

To test it properly:

  1. System Settings, then General, then Login Items & Extensions
  2. Switch the McAfee entries off under both Network Extensions and Endpoint Security Extensions
  3. Restart the Mac
  4. Run systemextensionsctl list again. If McAfee still shows as activated, it is still filtering
  5. Start Roon and try logging in

If it still shows after the reboot, uninstalling McAfee with their removal tool is the only reliable test. You can reinstall afterwards.

We still need the inner exception. What you pasted is the address enumeration. The cause is on the lines immediately after “see inner exception”. Please send the twenty lines that follow it.

Also, please turn Wi-Fi off. You have Ethernet and Wi-Fi both active on the same subnet, en0 192.168.28.32 and en1 192.168.28.59. Not the cause here, but it removes a variable and avoids other problems later.

5

Resolved

The cause was McAfee LiveSafe.

Disabling Real-Time Scanning, Firewall, WebAdvisor and VPN did not resolve the problem because the com.mcafee.CMF.networkextension system extension remained active.

After completely uninstalling McAfee (using the McAfee uninstaller) and rebooting, Roon authenticated successfully immediately.

This confirms the login loop was caused by the McAfee Network Extension interfering with Roon’s TLS connections.