NXDOMAIN means DNS failed. An RST on port 443 means TCP reachability or a network firewall blocked the socket before TLS started. ERR_CERT_COMMON_NAME_INVALID means TLS rejected the certificate binding. HTTP 401 Unauthorized or 403 Forbidden means the application gate rejected the caller’s identity or permissions.