Does a browser WebSocket survive CloudFront → NLB → Envoy → backend when the origin has a client certificate attached? AWS documents WebSockets as unsupported on an origin-mTLS origin. This page runs the scenarios that actually break in production — a single successful handshake proves very little on its own.
connecting…
The idle test is the slow one — it waits 70 s without traffic, which is past the point most intermediaries drop a quiet connection. Leave the tab open.