From cda901d049666475ff567c7fd372a5d505417d08 Mon Sep 17 00:00:00 2001 From: Alireza Hassani Date: Mon, 31 Aug 2026 16:32:10 +0330 Subject: [PATCH] Probe tenant dashboard TLS via business/customer.meshkee.com. The API VM resolver often NXDOMAINs business.* / customer.* CNAMEs even when the certs are valid, which made the SSL button always fail after a successful issue. Co-authored-by: Cursor --- src/common/tls-probe.ts | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/src/common/tls-probe.ts b/src/common/tls-probe.ts index 2aca672..a3ff4f6 100644 --- a/src/common/tls-probe.ts +++ b/src/common/tls-probe.ts @@ -1,6 +1,8 @@ import * as tls from 'tls'; const DEFAULT_TIMEOUT_MS = 4000; +const DASHBOARD_BUSINESS_HOST = 'business.meshkee.com'; +const DASHBOARD_CUSTOMER_HOST = 'customer.meshkee.com'; export type TlsProbeResult = { ok: boolean; @@ -8,6 +10,22 @@ export type TlsProbeResult = { expiresAt: Date | null; }; +/** + * Tenant dashboard names CNAME to Meshkee dashboards. The API VM resolver often + * NXDOMAINs those CNAMEs even when public DNS (and browsers) are fine — so TCP + * to the known dashboard host and use the tenant name only as SNI/identity. + */ +function tcpHostForTlsProbe(sniHost: string): string { + const host = sniHost.trim().toLowerCase(); + if (host.startsWith('business.') && host !== DASHBOARD_BUSINESS_HOST) { + return DASHBOARD_BUSINESS_HOST; + } + if (host.startsWith('customer.') && host !== DASHBOARD_CUSTOMER_HOST) { + return DASHBOARD_CUSTOMER_HOST; + } + return host; +} + function peerMatchesHost(host: string, socket: tls.TLSSocket): boolean { const cert = socket.getPeerCertificate(true); if (!cert || Object.keys(cert).length === 0) { @@ -64,7 +82,7 @@ export function probeTlsHostDetailed( try { socket = tls.connect( { - host, + host: tcpHostForTlsProbe(host), port: 443, servername: host, rejectUnauthorized: true,