Network errors look similar from a client, but the useful next step depends on where the connection stops.

Start with layers

First check whether the name resolves to the expected address. Then test the TCP connection. Only after that is it useful to inspect the TLS handshake or application response.

A timeout, a refused connection, and a certificate error point to different parts of the system. Treating them as identical usually sends debugging in the wrong direction.

Test from another location

A server may be reachable from its provider console but not from a client network. A second VPS in another location is a useful independent reference and takes only a few commands.

Keeping short notes about the failing layer and the successful test makes the next incident much easier to handle.