Why is my Tornado HTTPServer not responding to HTTPS requests?

I have an HTTPServing serving static files for testing some other code of mine. I need a server that responds to HTTPS requests to be able to test it properly. HTTP requests works just fine, however, HTTPS requests simply timeout on me:


[matt@arch ~] curl https://localhost:56714/empty.html -m 1 -vvk
*   Trying ::1:56714...
* Connected to localhost (::1) port 56714 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* Operation timed out after 1000 milliseconds with 0 out of 0 bytes received
* Closing connection 0
curl: (28) Operation timed out after 1000 milliseconds with 0 out of 0 bytes received

However, HTTP requests work just fine:

[matt@arch ~] curl http://localhost:56714/empty.html -m 1 -vvk
*   Trying ::1:56714...
* Connected to localhost (::1) port 56714 (#0)
> GET /empty.html HTTP/1.1
> Host: localhost:56714
> User-Agent: curl/7.69.1
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Server: TornadoServer/6.0.4
< Content-Type: text/html
< Date: Thu, 30 Apr 2020 02:12:50 GMT
< Accept-Ranges: bytes
< Etag: "d41d8cd98f00b204e9800998ecf8427e"
< Last-Modified: Tue, 21 Apr 2020 04:51:17 GMT
< Content-Length: 0
<
* Connection #0 to host localhost left intact

Here's the relevant portions of my code:

    ssl_ctx = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)
    parent_dir = Path(__file__).parent
    ssl_ctx.load_cert_chain(certfile=parent_dir / 'cert.pem', keyfile=parent_dir / 'private.key')
    port = get_free_port()
    app = _Application(handlers, static_path=static_path, ssl_options=ssl_ctx).listen(port)

I found this random comment on a related issue that suggests HTTP and HTTPS on the same port isn't possible, however I'm not sure if it still applies, and when I tried listening on more than one port it still didn't work.

Here's my cert.pem (don't worry, it's a test certificate):

And private.key:

Solution

From the curl log it seems you're not actually creating an HTTPS enabled server; it's not clear from your code how you're using the _Application later on.
The SSL context needs to be passed to HTTPServer not to Application; using the example in Tornado's docs should work:

ssl_ctx = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)
ssl_ctx.load_cert_chain(os.path.join(data_dir, "mydomain.crt"),
                        os.path.join(data_dir, "mydomain.key"))
HTTPServer(application, ssl_options=ssl_ctx)

Another issue is that you're trying to serve both HTTP and HTTPS content using the same port which is not supported by Tornado AFAIK.
Use separate ports (for example 8080 for HTTP and 8443 for HTTPS if you can't use 80 and 443); also for serving static content nginx might be a better choice.