diff --git a/src/frontend/xcecli/common/request/request.go b/src/frontend/xcecli/common/request/request.go
index fdf25c51..f321eef0 100755
--- a/src/frontend/xcecli/common/request/request.go
+++ b/src/frontend/xcecli/common/request/request.go
@@ -184,7 +184,7 @@ func ExtractErrorMessage(err error) string {
 
 	//Handle connection refused errors
 	if strings.Contains(errStr, "connection refused") {
-		return "connection refused"
+		return "cannot reach the API server -- it may still be starting up, retry shortly"
 	}
 
 	// Handle timeout errors
diff --git a/src/frontend/xcecli/common/request/request_test.go b/src/frontend/xcecli/common/request/request_test.go
index b8c53ca0..1e72a192 100644
--- a/src/frontend/xcecli/common/request/request_test.go
+++ b/src/frontend/xcecli/common/request/request_test.go
@@ -1,6 +1,46 @@
 package request
 
-import "testing"
+import (
+	"errors"
+	"testing"
+)
+
+func TestExtractErrorMessage(t *testing.T) {
+	tests := []struct {
+		name string
+		err  error
+		want string
+	}{
+		{
+			name: "connection refused is friendly, not raw",
+			err:  errors.New("dial tcp 127.0.0.1:8080: connect: connection refused"),
+			want: "cannot reach the API server -- it may still be starting up, retry shortly",
+		},
+		{
+			name: "timeout",
+			err:  errors.New("context deadline exceeded (Client.Timeout exceeded while awaiting headers): timeout"),
+			want: "connection timeout",
+		},
+		{
+			name: "network unreachable",
+			err:  errors.New("dial tcp: network unreachable"),
+			want: "network unreachable",
+		},
+		{
+			name: "dns not found",
+			err:  errors.New("dial tcp: lookup badhost: no such host"),
+			want: "host not found",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := ExtractErrorMessage(tt.err)
+			if got != tt.want {
+				t.Errorf("ExtractErrorMessage(%q) = %q, want %q", tt.err, got, tt.want)
+			}
+		})
+	}
+}
 
 func TestAuthHeaderConsistency(t *testing.T) {
 	token := "test-token-abc"