Custom domain summon.stars.realm.watch — TLS handshake failure, cert not provisioning

[jphein]

Symptom

Connecting to `https://summon.stars.realm.watch\` fails with a TLS-level rejection from Cloudflare's edge:

```
$ curl -v https://summon.stars.realm.watch

• Connected to summon.stars.realm.watch (172.67.223.156) port 443
• TLSv1.3 (OUT), TLS handshake, Client hello (1):
• TLSv1.3 (IN), TLS alert, handshake failure (552):
• OpenSSL/3.0.13: error:0A000410:SSL routines::sslv3 alert handshake failure
  ```

The TLS handshake never completes. Cloudflare sends `alert handshake failure (552)` immediately, which means no certificate matches the SNI for this hostname.

Effect

Custom-star summons fail end-to-end from any client. The SPA at `stars.realm.watch` was temporarily repointed at the workers.dev URL (`starcharts-summon.jp5.workers.dev`) so the user-facing flow works while this is unresolved — see `app/src/lib/summon.ts` line that says "Temporarily pointing at the workers.dev URL while the cert for summon.stars.realm.watch reprovisions".

What's NOT broken

• DNS resolves correctly to Cloudflare anycast IPs (`172.67.223.156`, `104.21.46.42`) from both LAN and public DNS.
• Other Cloudflare endpoints (`cloudflare.com`, `workers.cloudflare.com`) terminate TLS fine from the same machine.
• The Worker itself works perfectly via `https://starcharts-summon.jp5.workers.dev/api/summon\` — verified with a 90s curl returning a real R2 PNG URL in 15s.
• `wrangler deploy` reports the custom domain as bound on every push:
  ```
  Deployed starcharts-summon triggers
  summon.stars.realm.watch (custom domain)
  ```

What I tried

1. Re-deployed multiple times (worker + custom-domain re-binding).
2. Removed and re-added the `[[routes]]` block in `wrangler.toml` to force Cloudflare to drop and re-provision. Block is now back in place; deploy succeeded; cert still rejects.
3. Tried both LAN and remote DNS; same TLS failure.
4. Checked Cloudflare account ownership / zone state via wrangler — looks correct.

Next step

This needs a human visit to the Cloudflare dashboard:

• realm.watch zone → SSL/TLS → Edge Certificates to inspect the cert state for `summon.stars.realm.watch`. Likely options: "Pending Validation", "Validation Failed", or it's missing from the SAN entirely.
• If validation is failing, check whether the zone's SSL/TLS mode is set to a level the Worker custom-domain expects (probably "Flexible" or "Full").
• A worst case is opening a Cloudflare support ticket for stuck Universal SSL provisioning — they typically fix this in <24h.

Workaround until resolved

`app/src/lib/summon.ts` and `app/src/lib/join.ts` both default to `https://starcharts-summon.jp5.workers.dev/...\` instead of the custom domain. Both can be flipped back via a single-line change once the cert is healthy. `RUNBOOK.md` "What's deployed where" still references the custom domain because the binding is registered server-side, just unable to terminate TLS.

Tracking

• Comment in `app/src/lib/summon.ts` mentions this issue.
• Worker-side `wrangler.toml` still asserts the custom domain so when the cert heals, no code change is needed on that side.