Locate the failure stage
The same user symptom can have different causes.
A connection refused or reset can point to the transport stage. A certificate warning points toward TLS (Transport Layer Security) negotiation and identity checks. An HTTP status such as 404 or 503 means an HTTP response was received, so lower layers progressed far enough to answer.
These clues narrow the search; they do not identify every root cause by themselves. Compare the error with timing, headers, logs, and repeated requests.
Read the stages in order
Later evidence narrows what happened earlier.
An HTTP response means an HTTP responder was reached, so the exchange progressed far enough through transport and, for HTTPS, secure negotiation to return an application-level message. A 503 can still represent a serious service failure; it does not mean the application succeeded.
Likewise, a TLS alert tells you more than a transport timeout because the peers exchanged enough information to negotiate security. Interpret the evidence in sequence, while remembering that a proxy or intermediary may have produced the response.
Build the model
Four error clues
Transport
Connection refused, reset, or timeout before an application response.
TLS
Certificate, identity, or secure negotiation failure.
HTTP status
A server response such as 404 Not Found or 503 Service Unavailable.
Headers
Metadata that describes how the HTTP exchange should be handled.
Mini investigation
Classify a symptom
Select the observed symptom and identify the most direct layer clue.
Connection refused means the client did not establish the expected transport connection.
Start with reachability, listening service, port, and filtering checks.
Knowledge check
Test your protocol error model
Answer eight questions. The answer order changes each time.