curl to an internal service hangs and times out. Debug it layer by layer.

Go up the stack and stop at the first layer that fails:

1. 1DNSdig billing.internal (or nslookup). Does it resolve, and to the IP you expect?
2. 2Routing and TCPnc -vz <ip> 443 or curl -v. A hang (not "connection refused") usually means a firewall, security group or network policy is dropping packets.
3. 3TLSopenssl s_client -connect host:443 -servername host. Check the certificate chain, expiry and SNI.
4. 4HTTPcurl -v shows the status, redirects and headers. A 30-second hang after connecting points to the backend being slow.

Refused = nothing listening. Timeout = dropped on the way. Telling those apart is half the job.