RDGRS-2521 — WebSocket through CloudFront to an mTLS origin

Does a browser WebSocket survive CloudFront → NLB → Envoy → backend when the origin has a client certificate attached? AWS documents WebSockets as unsupported on an origin-mTLS origin. This page runs the scenarios that actually break in production — a single successful handshake proves very little on its own.

connecting…

Scenarios

The idle test is the slow one — it waits 70 s without traffic, which is past the point most intermediaries drop a quiet connection. Leave the tab open.

Connection