The first attempt failed and the second worked. Why?

Almost always the access point rather than the certificate. Where one SSID is carried by several access points, each holds its own connection to Passbeam — a device landing on one that has not connected yet can time out while a warm one joins in a couple of seconds.

We have chased exactly this on real hardware and can usually tell from the log which side gave up first, so it is worth a ticket with the timestamps if you see it.