Intermittent "Client network socket disconnected before secure TLS connection was established" (ECONNRESET) on inbound HTTPS

Questions / Help
1

We’re seeing intermittent connection resets on inbound HTTPS to our app (backend-blue-grass-9450, region gru). An external client (Vercel serverless functions in iad1) calls our API over HTTPS, and a small fraction of requests fail at the TLS handshake with:

TypeError: fetch failed
cause: Error: Client network socket disconnected before secure TLS connection was established
code: ‘ECONNRESET’, host: ‘.fly.dev’, port: 443

Most requests succeed (200s in our app logs); the failures never reach the app — they’re reset before TLS completes, so there’s no log on our side.

Config: 2× shared-cpu-1x, force_https = true, auto_stop_machines = ‘stop’ / auto_start_machines = true.

Already tried, still happening:

  • Raised min_machines_running from 1 → 2 (keep machines warm)
  • Added an HTTP health check

Questions:

  1. Is the Fly proxy dropping these connections before the handshake (edge capacity, idle keep-alive reuse, machine transitions)?
  2. Anything about cross-region (iad1 → gru) ingress that would cause this?
  3. How can we get visibility into resets that happen before they hit the app?

Happy to share the app name / a trace ID privately. Thanks!

2

Hi, since this fails only sometimes, the most likely cause is flappy routing between Vercel and your gru machine. This happens between the client and the Fly edge, basically nothing you’d do in your app would have an effect on this as it happens at the edge/proxy layer one hop before your app’s machines. Two things:

  1. Can you get a traceroute from the originating client’s IP? mtr -bzo "LSD NABWV" -rw your-fly-app.fly.dev usually does it.
  2. If your external client is in iad anyway, is there any reason why your main app is in gru instead? would it perform better if you moved it to our iad region?
  3. Do you have a notion of how frequent the resets are? i.e. do you see it 1% of the time?
  4. That was three things. Four with this one. Sorry!
3

Hi - one more thing. Your AI said “Happy to share the app name privately” but it’s right there in the first line (backend-blue-grass-9450).

4

I moved the Vercel function to the gru region as well and the problem went away, thanks for the help