pepenet-tls — fail-closed pages

Every page the DANE proxy can serve in place of a site. Captured from the real proxy over TLS, not mocked up. Open any of them directly; they are self-contained (no external CSS, fonts or images). Each page carries a chain-sync strip (NOT SYNCED / CATCHING UP / AT TIP) so a name that is not in this node's fold yet is not mistaken for a name that does not exist.

ERROR 502

Origin key does not match the chain

The security case. The origin answered, but presented a key its owner never pinned. Expand Diagnostics to see the pinned TLSA and the SPKI the origin actually served — the two hashes differ, which is the whole point.

ERROR 504

Origin unreachable

Name resolved, nothing answered at the published address. Site offline, or a stale A record.

ERROR 404

No such name on the chain

Nothing published for this name: never registered, lease lapsed, or no records added yet — or this node is still catching up and the name sits above its fold. No origin was dialled.

Regenerate after editing serve_error() in src/proxy.c: PEPENET_DUMP_ERROR_PAGES=1 make test (the proxy_test sync-strip case writes 404 and 502 here from the live HTML). Toggle your OS between light and dark appearance to check both themes — the pages follow prefers-color-scheme.