Interesting! I had went out of my way to add support for TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384--because I consider older versions of Safari critical for my audience--but the way I did that dragged in TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA; I've gone ahead and filtered out SHA1 (so maybe / hopefully this will help).