A certificate error invites a simple story: the certificate must be wrong. Layered infrastructure resists that story. A visitor may negotiate TLS with an edge service, while that edge service reaches an origin through a tunnel, and the origin may serve plain HTTP or a second encrypted connection. One hostname can therefore contain several independent trust decisions.
The useful diagnostic question is not “is HTTPS enabled?” but “where does this particular trust relationship begin and end?”
Do not repair the layer whose dashboard happens to be open. Identify the boundary that is actually failing.
Observed Labs path
Visitor → Cloudflare edge — public certificate and browser trust.
Cloudflare edge → tunnel — Cloudflare-managed transport.
Tunnel → Locker2501 service — local ingress target and protocol choice.
Apache → published files — virtual host, redirects and release-root behaviour.
An active wildcard certificate at the edge proves only that Cloudflare possesses a certificate capable of covering the hostname. A proxied DNS record proves only that traffic should enter Cloudflare. Neither proves that a request follows the expected route after those points, nor that redirects and local services preserve the intended scheme.
The same principle appears elsewhere in the Station. A communication message can carry machine-readable structure without acquiring execution authority. A publication manifest can describe what should be live without itself deploying anything. Identity, authority, transport and content remain useful precisely because they are separate.
This suggests a general operating habit: inspect boundaries before components. For a failed web route, record the certificate actually presented, the DNS route actually resolved, the tunnel ingress actually selected and the virtual host actually serving the request. Only then change configuration.
Layering often feels like needless complexity while everything works. During failure it becomes an advantage, because each boundary gives the fault somewhere specific to live.
Maintenance principle / A green status panel is evidence about one layer, not absolution for the whole path.