Relay subdomain SSL handshake failed

[MapleStoryIdle]

Problem

The relay subdomain SSL handshake fails. Main domain relay.hapi.run works fine, but user subdomains cannot complete SSL handshake.

Test Results

Domain	SSL Status
relay.hapi.run	✅ Works
*.relay.hapi.run (user subdomains)	❌ SSL handshake failed

Details

Old subdomain: 43aaf5t23io544c4.relay.hapi.run
New subdomain: 2wz5fpklf22fq4c4.relay.hapi.run

Both fail with:

curl: (35) LibreSSL SSL_connect: SSL_ERROR_SYSCALL in connection to *.relay.hapi.run:443

OpenSSL test:

$ openssl s_client -connect 2wz5fpklf22fq4c4.relay.hapi.run:443 -servername 2wz5fpklf22fq4c4.relay.hapi.run
error:0A000126:SSL routines::unexpected eof while reading
no peer certificate available

Environment

• hapi version: 0.16.4
• OS: macOS 15.3 (arm64)
• Node: v22.22.0

Steps to Reproduce

1. hapi hub --relay
2. Wait for relay URL to appear
3. Try to access the relay URL - SSL handshake fails

The tunwg process keeps showing:

[Tunnel] Waiting for trusted TLS certificate...

Please help investigate. Thanks!

[github-actions]

From the 0.16.4 source in this repo, your symptom matches the relay TLS readiness gate not completing.

When hapi hub --relay starts, the hub brings up the tunnel first, then repeatedly probes the generated HTTPS tunnel URL until the peer presents a trusted certificate. That probe only succeeds if the certificate is authorized, has a matching hostname/SAN for the generated subdomain, and is within its validity window. Until then, the hub keeps logging Waiting for trusted TLS certificate... and does not consider the relay ready.

I also checked the failure handling in that probe: socket errors, missing peer certificate, unauthorized certificate, hostname mismatch, and invalid certificate dates are all collapsed into the same false result, so the current code does not expose a more specific reason in logs. I did not find a narrower in-repo diagnostic for the subdomain SSL failure beyond that.

The only documented relay transport knob I found is HAPI_RELAY_FORCE_TCP=true; the docs explicitly recommend trying that when relay connectivity has trouble.

Relevant code:

• hub/src/index.ts:242 - starts the tunnel; then waits for TLS readiness before announcing the public URL
• hub/src/index.ts:252 - waitForTunnelTlsReady(tunnelUrl, manager) gates relay readiness
• hub/src/tunnel/tlsGate.ts:116 - TLS probe logic for the tunnel host
• hub/src/tunnel/tlsGate.ts:145 - probe rejects unauthorized or missing peer certs
• hub/src/tunnel/tlsGate.ts:104 - certificate must match hostname and validity window
• hub/src/tunnel/tlsGate.ts:195 - emits Waiting for trusted TLS certificate...
• hub/src/index.ts:238 - HAPI_RELAY_FORCE_TCP toggles relay transport mode
• docs/guide/installation.md:143 - docs recommend HAPI_RELAY_FORCE_TCP=true if relay connectivity fails

Need more info:

• Please try HAPI_RELAY_FORCE_TCP=true hapi hub --relay and report whether the TLS handshake still fails.
• Please paste the hub log from [Tunnel] Starting tunnel... through the first few Waiting for trusted TLS certificate... lines.
• Please confirm how hapi was installed: official npm registry, Homebrew, or prebuilt binary.

---

HAPI Bot

[MapleStoryIdle]

Thanks for the quick response!

Test Results with HAPI_RELAY_FORCE_TCP=true

Still failing with SSL connection timeout:

$ HAPI_RELAY_FORCE_TCP=true hapi hub --relay

[Tunnel] Starting tunnel to http://localhost:3006...
[Tunnel] 2026/03/26 20:21:36 tunwg: initiating handshake to server
[Tunnel] 2026/03/26 20:21:42 tunwg: http://localhost:3006 <= https://2wz5fpklf22fq4c4.relay.hapi.run

HAPI Hub is ready!
[Tunnel] Waiting for trusted TLS certificate...
[Tunnel] Waiting for trusted TLS certificate...
[Tunnel] Waiting for trusted TLS certificate...

$ curl -v --connect-timeout 10 https://2wz5fpklf22fq4c4.relay.hapi.run/
* Connected to 2wz5fpklf22fq4c4.relay.hapi.run (43.130.231.139) port 443
* (304) (OUT), TLS handshake, Client hello (1):
* SSL connection timeout
curl: (28) SSL connection timeout

Installation Method

$ hapi --version
hapi version: 0.16.4

Installed via: npm install -g @twsxtd/hapi

The tunnel subdomain DNS resolves correctly to 43.130.231.139, TCP connection succeeds, but TLS handshake never completes. The server does not send any certificate back.

Let me know if you need any additional diagnostics.