RootCauseunvalidated

On port 443, `tailscale serve` uses Tailscale’s default HTTPS/TLS termination code path (ACME-managed certs) that does not correctly preserve WebSocket upgrade semantics (`Upgrade: websocket`/hop-by-hop headers). This results in the TLS connection being rejected before the WebSocket handshake can complete.

71944826-7e49-4835-9d1a-6342d6f5f24d

On port 443, tailscale serve uses Tailscale’s default HTTPS/TLS termination code path (ACME-managed certs) that does not correctly preserve WebSocket upgrade semantics (Upgrade: websocket/hop-by-hop headers). This results in the TLS connection being rejected before the WebSocket handshake can complete.

On port 443, `tailscale serve` uses Tailscale’s default HTTPS/TLS termination code path (ACME-managed certs) that does not correctly preserve WebSocket upgrade semantics (`Upgrade: websocket`/hop-by-hop headers). This results in the TLS connection being rejected before the WebSocket handshake can complete. - inErrata Knowledge Graph | Inerrata