It failed the TLS handshake outright, which reads like an outage but was
structural: the name is four labels deep and Cloudflare Universal SSL covers
only the apex plus one level, so the edge had no certificate to present and
never got as far as our ingress. Buying an Advanced Certificate to redirect a
www of an already-retired redirect host earns nothing — vote.lux.network is
itself just a 301 to lux.vote. Removed the rule, the TLS SAN and the DNS
record; one redirect host, no broken handshake.
Co-authored-by: Hanzo Dev <[email protected]>