Troubleshoot network problems

Che requires WebSocket Secure (WSS) connections. Firewalls, proxies, or load balancers that strip WebSocket headers cause workspace failures. Secure WebSocket connections improve confidentiality and reduce the risk of interference by bad proxies.

Prerequisites

You have an active Che workspace URL or dashboard URL.

Procedure

Verify that the browser supports WebSocket connections by opening the browser developer tools (F12), navigating to the Console tab, and running:
```
var ws = new WebSocket('wss://echo.websocket.org');
ws.onopen = function() { console.log('WebSocket OK'); ws.close(); };
ws.onerror = function() { console.log('WebSocket FAILED'); };
```
If the output is WebSocket FAILED, WebSocket connections are blocked. Contact your network administrator to allow WSS connections on port 443.
Verify that firewall rules allow WebSocket Secure (WSS) connections on port 443 to the Che hostname.
If your network uses a proxy server, verify that the proxy allows WebSocket upgrade requests. Some proxies block HTTP upgrade headers by default.
Verify DNS resolution from a workspace terminal:
```
nslookup <{prod-id-short}_hostname>
```
If the DNS lookup fails, the workspace Pod cannot resolve the Che hostname. Verify the cluster DNS configuration and any custom DNS settings in the workspace namespace.
If you encounter x509: certificate signed by unknown authority errors when connecting to an HTTPS endpoint from inside a workspace, the workspace does not trust the TLS certificate.

Contact your administrator to import the required Certificate Authority (CA) certificates.

Verification

Open a workspace and verify that the IDE loads without connection errors.
Verify that Git operations (clone, push, pull) complete without network timeouts.

Additional resources