Wildcard DNS + ndots:5: The TLS Nightmare and How to Fix It

I was trying to pull a model from an external registry into my cluster when the connection just died. No 404, no timeout, just a blunt SSL: CERTIFICATE_VERIFY_FAILED . The error message specifically complained about a RemoteCertificateNameMismatch . THE SYMPTOM The error was explicit: the certificate presented by the IP address I was hitting didn't match the hostname I requested. When I checked the logs, the client was attempting to connect to registry.ollama.ai , but the server responding was a