Origin key does not match its published pin

The server answered, but the certificate it presented is not the one this name's owner published. Access was refused. This is the protection working as intended — either someone is impersonating this name, or its operator rotated keys without publishing a matching TLSA record. Compare the pinned key with the one the origin actually presented in the verdict below; its verify code names the precise reason.

name (SNI)

bad.pepenet.doge

published origin (A record)

127.0.0.1:55108

published TLSA (pinned key)

3 1 1 db4fd93a45f0adbb42e574fbb944b39988e3a1d5941bad35aab60bb7e7d1f981

this node

block 1,234,567

network tip

2,000,000

DANE verdict

verify=65: no matching DANE TLSA records — origin presented spki-sha256 244fd93a45f0adbb42e574fbb944b39988e3a1d5941bad35aab60bb7e7d1f981

These records are signed by the name's owner, not supplied by the server that answered. The proxy refuses to relay any byte from an origin whose key does not match the published pin.