PMS 1.43 serves TLS-only on 32400: a plain-HTTP GET gets a TLS alert and curl reports "empty reply from server" (exit 52, code 000), so the card read down while Plex answered 200 at /web/index.html over HTTPS. TCP connect is the honest liveness signal for this port; the public URL stays HTTP because Caddy terminates TLS and re-keys the path.