Search code examples
nginxsslhttpssslhandshakeexceptionbad-gateway

Server domain returning 502 Bad Gateway - Nginx

I am not able to access my server through domain name. Its showing 502 Bad Gateway.

Error log showing SSL_do_handshake() failed.

But its running successfully when i access through ip address.

/etc/nginx/sites-available/default file

/var/log/nginx/error.log showing this error -

[error] 13728#13728: *1 SSL_do_handshake() failed (SSL: error:1408F10B:SSL routines:ssl3_get_record:wrong version number) while SSL handshaking to upstream, client: 179.43.169.181, server: www.myvaccinenotifier.me, request: "GET / HTTP/1.1", upstream: "https://128.199.21.142:3000/", host: "myvaccinenotifier.me"

Probably its due to some mistage in nginx configuration... Help me correct it.

PS: I'm new to this.

Solution

  • Not much is known about your setup, but one can make the following observations:

    • On HTTP there is a proxy_pass http://127.0.0.1:3000, which suggests that there is some internal server on port 3000 and that nginx should work as reverse proxy
    • On HTTPS there is a proxy_pass https://128.199.21.142:3000/, i.e. same port as with HTTP but different IP address and especially also a different protocol to access the upstream, i.e. https:// instead of http://.
    • The IP address is the external IP address of the server itself. So it looks for me like you exposing the internal app on port 3000 also directly to the internet.
    • Only, you then access this application with https:// and not http://. It is very unlikely that the app supports both HTTP and HTTPS on the same port, so it is likely that it should have been http:// and not https:// to access the internal application. This is actually a common problem and the "wrong version number" is a common error message seen with such a broken setup.

    Recommendations:

    • Change proxy_pass https://128.199.21.142:3000/ to proxy_pass http://127.0.0.1:3000, i.e. exactly the same upstream for port 80 http and port 443 https.
    • Don't expose the internal app to the internet, i.e. make it listen only on 127.0.0.1 and/or block access from the internet using firewall rules.