The first attempt failed and the second worked. Why?

It's usually the access point, not the certificate. When several access points carry one SSID, each keeps its own connection to Passbeam. A device that joins one that hasn't connected yet can time out, while one that's already connected answers in a couple of seconds.

If you see this, raise a ticket with the times. We can usually tell from the log which side gave up first.