Since Monday, the branch enrolment kiosks can no longer reach the API, while the website works

In the MasterLinux branches (Casablanca, Rabat, Fez, Oujda, Agadir), 46 kiosks let applicants pay their enrolment fees by card and print their receipt. They call the API https://terminaux.masterlinux.lab, served, like api.masterlinux.lab (website and mobile app), by the global external HTTPS load balancer of project masterlinux-prod.

Since Monday morning, every kiosk displays “Erreur de connexion sécurisée (-2)”. Applicants pay at the counter, queues grow; the kiosk manufacturer, when contacted, replies that their firmware “has not changed since 2016”. The website and the mobile app work normally.

On Monday, the security team applied a recommendation from the annual audit (CHG-2231 “TLS hardening of the front ends”). The CISO will not hear of a global rollback; branch management wants the kiosks back in service today. Replacing the kiosks is budgeted for the first quarter.

You are the cloud and security engineer, on ml-poste-01 (gcloud, openssl, curl, dig). The support team has dropped a kiosk log in ~/tickets/INC-3265/.