Cisco Umbrella

This is the configuration we see cause problems most often, so it is worth calling out directly.

What we observe on affected devices

Devices receive a certificate for medjot.app that is not ours:

Field	Value on affected devices	Our genuine certificate
Issuer	Cisco Umbrella Secondary SubCA lon-SG (O = Cisco)	Let's Encrypt, chaining to ISRG Root X1
Subject organisation	OpenDNS, Inc.	CN=medjot.app
Validity	5 days	90 days
Key	RSA 2048	RSA 4096
iOS status	Not Trusted	Trusted

This is SSL decryption in the Umbrella Secure Web Gateway. The Umbrella root CA does not appear to be trusted on these devices, so once traffic is decrypted and re-signed, iOS rejects it outright.

Why MedJot and not other sites

Cisco Talos categorises medjot.app as "Health and Medicine", with a Neutral reputation and no block-list entries. Where a policy decrypts that category, MedJot breaks.

The instructive comparison is our sister application, ACTrack (actrack.app). It runs on the same servers with a certificate from the same authority, and it works correctly on the same iPads — because Talos has no established content category for it, so it is not inspected.

The difference is the category, not the application. Accurate categorisation is what causes the problem, which is not an outcome anyone intended.

The fix

Add a Do Not Decrypt entry:

medjot.app
*.medjot.app

In Umbrella this is under the SSL Decryption settings of the relevant web policy, as a destination list marked for decryption bypass.

Also worth checking

Confirm separately that your Umbrella root CA is deployed and trusted on managed devices.

On iOS, installing the certificate is not sufficient — it must also be enabled under:

Settings → General → About → Certificate Trust Settings

Where that step is missed, every inspected domain outside Cisco's default do-not-decrypt list fails in exactly the same way. MedJot may simply be the first one reported to you.

Why users cannot click through

.app is an HSTS-preloaded top-level domain, enforced by every major browser. Safari offers no "visit anyway" option. This is a hard block, not a dismissible warning. See TLS inspection.

Escalating internally

If you need something to forward, the essentials are:

• MedJot (https://medjot.app) is blocked on managed devices by Umbrella SSL decryption.
• The certificate received is issued by Cisco Umbrella Secondary SubCA lon-SG; the genuine one is from Let's Encrypt.
• .app is HSTS-preloaded, so this is a hard block with no user workaround.
• The requested change is a Do Not Decrypt entry for medjot.app and *.medjot.app.
• Decrypting MedJot exposes no clinical content (none is in transit) but does expose authentication and refresh tokens for a clinical system.

We are happy to join a call with whoever manages the Umbrella policy — hello@swyftscale.com.