Probe tenant dashboard TLS via business/customer.meshkee.com.

The API VM resolver often NXDOMAINs business.* / customer.* CNAMEs even when the certs are valid, which made the SSL button always fail after a successful issue.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/common/tls-probe.ts

@@ -1,6 +1,8 @@
 import * as tls from 'tls';
 
 const DEFAULT_TIMEOUT_MS = 4000;
+const DASHBOARD_BUSINESS_HOST = 'business.meshkee.com';
+const DASHBOARD_CUSTOMER_HOST = 'customer.meshkee.com';
 
 export type TlsProbeResult = {
   ok: boolean;
@@ -8,6 +10,22 @@ export type TlsProbeResult = {
   expiresAt: Date | null;
 };
 
+/**
+ * Tenant dashboard names CNAME to Meshkee dashboards. The API VM resolver often
+ * NXDOMAINs those CNAMEs even when public DNS (and browsers) are fine — so TCP
+ * to the known dashboard host and use the tenant name only as SNI/identity.
+ */
+function tcpHostForTlsProbe(sniHost: string): string {
+  const host = sniHost.trim().toLowerCase();
+  if (host.startsWith('business.') && host !== DASHBOARD_BUSINESS_HOST) {
+    return DASHBOARD_BUSINESS_HOST;
+  }
+  if (host.startsWith('customer.') && host !== DASHBOARD_CUSTOMER_HOST) {
+    return DASHBOARD_CUSTOMER_HOST;
+  }
+  return host;
+}
+
 function peerMatchesHost(host: string, socket: tls.TLSSocket): boolean {
   const cert = socket.getPeerCertificate(true);
   if (!cert || Object.keys(cert).length === 0) {
@@ -64,7 +82,7 @@ export function probeTlsHostDetailed(
     try {
       socket = tls.connect(
         {
-          host,
+          host: tcpHostForTlsProbe(host),
           port: 443,
           servername: host,
           rejectUnauthorized: true,