Add raw TLS-only handshake diagnostic to isolate TLS layer from HTTP layer

api/Cargo.lock

@@ -755,6 +755,21 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
 
+[[package]]
+name = "foreign-types"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1"
+dependencies = [
+ "foreign-types-shared",
+]
+
+[[package]]
+name = "foreign-types-shared"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"
+
 [[package]]
 name = "form_urlencoded"
 version = "1.2.2"
@@ -1859,6 +1874,23 @@ dependencies = [
  "typenum",
 ]
 
+[[package]]
+name = "native-tls"
+version = "0.2.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "465500e14ea162429d264d44189adc38b199b62b1c21eea9f69e4b73cb03bbf2"
+dependencies = [
+ "libc",
+ "log",
+ "openssl",
+ "openssl-probe",
+ "openssl-sys",
+ "schannel",
+ "security-framework",
+ "security-framework-sys",
+ "tempfile",
+]
+
 [[package]]
 name = "nonempty"
 version = "0.7.0"
@@ -1999,6 +2031,7 @@ dependencies = [
  "imageproc",
  "jsonwebtoken",
  "moka",
+ "native-tls",
  "openposterdb-api",
  "rand 0.9.2",
  "reqwest",
@@ -2011,6 +2044,7 @@ dependencies = [
  "tempfile",
  "thiserror 2.0.18",
  "tokio",
+ "tokio-native-tls",
  "tower",
  "tower-http",
  "tower_governor",
@@ -2020,12 +2054,49 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "openssl"
+version = "0.10.81"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77823a27f0babb03091cb9ed9ef80af3b39dbc82f97e8fa530374b7dafd87a45"
+dependencies = [
+ "bitflags",
+ "cfg-if",
+ "foreign-types",
+ "libc",
+ "openssl-macros",
+ "openssl-sys",
+]
+
+[[package]]
+name = "openssl-macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "openssl-probe"
 version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
 
+[[package]]
+name = "openssl-sys"
+version = "0.9.117"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b47e7e6bb2c38cd930d25a23b40fa52e068c10e85f3e03a7f5ba5aaca5713695"
+dependencies = [
+ "cc",
+ "libc",
+ "pkg-config",
+ "vcpkg",
+]
+
 [[package]]
 name = "ordered-float"
 version = "4.6.0"
@@ -3554,6 +3625,16 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "tokio-native-tls"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbae76ab933c85776efabc971569dd6119c580d8f5d448769dec1764bf796ef2"
+dependencies = [
+ "native-tls",
+ "tokio",
+]
+
 [[package]]
 name = "tokio-rustls"
 version = "0.26.4"

api/Cargo.toml

@@ -32,6 +32,8 @@ tower = { version = "0.5.3", features = ["util"] }
 tower_governor = { version = "0.8.0", default-features = false, features = ["axum"] }
 utoipa = { version = "5.4.0", features = ["axum_extras"] }
 hickory-resolver = "0.24"
+tokio-native-tls = "0.3"
+native-tls = "0.2"
 
 [features]
 test-support = []

api/src/handlers/admin.rs

@@ -793,6 +793,36 @@ pub async fn network_diagnostics() -> axum::Json<serde_json::Value> {
             }
         }
 
+        // Stage 2b: raw TLS handshake only, no HTTP request — isolates TLS itself
+        // from anything reqwest/HTTP-specific.
+        let t1b = Instant::now();
+        let tls_result = tokio::time::timeout(std::time::Duration::from_secs(10), async {
+            let tcp = tokio::net::TcpStream::connect(addr).await?;
+            let native_connector = native_tls::TlsConnector::new()
+                .map_err(|e| std::io::Error::new(std::io::ErrorKind::Other, e.to_string()))?;
+            let connector = tokio_native_tls::TlsConnector::from(native_connector);
+            let _tls_stream = connector.connect(host, tcp).await
+                .map_err(|e| std::io::Error::new(std::io::ErrorKind::Other, e.to_string()))?;
+            Ok::<(), std::io::Error>(())
+        }).await;
+        let tls_ms = t1b.elapsed().as_millis();
+        match tls_result {
+            Ok(Ok(())) => {
+                results.insert("tls_handshake_only_ms".into(), serde_json::json!(tls_ms));
+                results.insert("tls_handshake_only_ok".into(), serde_json::json!(true));
+            }
+            Ok(Err(e)) => {
+                results.insert("tls_handshake_only_ms".into(), serde_json::json!(tls_ms));
+                results.insert("tls_handshake_only_ok".into(), serde_json::json!(false));
+                results.insert("tls_handshake_only_error".into(), serde_json::json!(e.to_string()));
+            }
+            Err(_) => {
+                results.insert("tls_handshake_only_ms".into(), serde_json::json!(tls_ms));
+                results.insert("tls_handshake_only_ok".into(), serde_json::json!(false));
+                results.insert("tls_handshake_only_error".into(), serde_json::json!("timed out after 10s"));
+            }
+        }
+
         // Stage 3b: same request, but forced to HTTP/1.1 only — isolates whether a
         // PMTU/fragmentation blackhole on larger HTTP/2 handshake/frame packets is the cause.
         let t2b = Instant::now();