Stata internet commands and the OS TLS/DNS stack: distinguishing certificate failures from DNS errors

Stata's internet commands (copy, urlfetch, webuse, ssc install) delegate DNS resolution and HTTPS certificate validation to the host operating system and its networking library. Stata does not ship its own resolver or CA store, and there is no documented Stata-level option to disable certificate checks or point to a custom CA bundle.

The practical problem is that the error text Stata surfaces is generic — typically a connection-style failure — with little distinction between a DNS resolution failure, proxy interference, and a certificate chain validation failure. The exact wording and behavior also appear to vary by Stata release and platform, since they follow whatever OS and library configuration is active at runtime.

The goal is a reliable, repeatable way to classify the failure cause from a Stata session before falling back to external tools such as nslookup or openssl s_client, and to understand how much of the diagnosis must live outside Stata by design.

Is there any documented Stata setting, return code, or diagnostic output that separates DNS, proxy, and certificate validation failures for internet commands? Does the answer differ across Windows, macOS, and Linux builds of the same Stata version? If not, what is the minimal supported approach for confirming the failure layer when Stata itself cannot report it?