| Browser/curl rejects the cert |
Server is on ACME staging (untrusted). Switch off staging + restart, or use curl -k for testing. (Switching staging→production now moves the cached staging cert aside automatically so production re-issues.) |
| New domain shows a cert warning at first, but works in an incognito window (then your normal profile "catches up") |
A browser reached the URL before issuance/DNS settled and cached the failure. The client now verifies a browser-trusted certificate is actually being served before it prints Tunnel live — wait for that line, then hard-reload the tab (Cmd/Ctrl-Shift-R) to clear the cached error. |
404 no tunnel configured |
No frontend exists for that Host. Create one (serve). |
502 tunnel offline |
The frontend exists but no client is connected. Start the client; it auto-reconnects. |
403 Blocked host (Rails/Django/etc.) |
Your app rejects the public hostname. Add it to the framework's allowed-hosts (e.g. Rails config.hosts). |
| First request to a new domain is slow / fails |
Cert is issuing on demand; ensure DNS points at the server and :80/:443 are reachable. |
| Too many requests (429) |
Repeated bad API keys/tokens trigger a temporary per-IP lockout. Wait, then use the correct credential. |