Name resolution comes first
Confirm that the requested hostname resolves to the intended destination. Consider cached DNS answers and the difference between the host network, a container network and an external client.
Check the same name from the environment where the failure occurs. A successful lookup from your workstation is not evidence about another network.
Then validate transport and routing
Inspect certificate hostname coverage, validity and chain trust. Do not fix an invalid certificate by disabling validation in application code.
Once TLS succeeds, check proxy routing rules, upstream host and port, and the protocol expected by the backend. Separate a route mismatch from an unavailable upstream.
Finally inspect application assumptions
Applications behind TLS termination may need correct forwarded scheme and host information. Incorrect assumptions can affect redirects, secure cookies and identity callback URLs.
Write down the path from public hostname to process. Test each boundary with the smallest possible request, and keep credentials out of captured diagnostics.
Further reading
Primary documentation & specification