Server domain returning 502 Bad Gateway - Nginx

Question

I am not able to access my server through domain name. Its showing 502 Bad Gateway.

Error log showing SSL_do_handshake() failed.

But its running successfully when i access through ip address.

/var/log/nginx/error.log showing this error -

[error] 13728#13728: *1 SSL_do_handshake() failed (SSL: error:1408F10B:SSL routines:ssl3_get_record:wrong version number) while SSL handshaking to upstream, client: 179.43.169.181, server: www.myvaccinenotifier.me, request: "GET / HTTP/1.1", upstream: "https://128.199.21.142:3000/", host: "myvaccinenotifier.me"

Probably its due to some mistage in nginx configuration... Help me correct it.

PS: I'm new to this.

Please don't include textual content (the configuration) as an external image. Include it instead directly as text and properly formatted into your question. — Steffen Ullrich, Jun 29 '21 at 20:42

score 2 · Accepted Answer · answered Jun 29 '21 at 20:41

Not much is known about your setup, but one can make the following observations:

On HTTP there is a proxy_pass http://127.0.0.1:3000, which suggests that there is some internal server on port 3000 and that nginx should work as reverse proxy
On HTTPS there is a proxy_pass https://128.199.21.142:3000/, i.e. same port as with HTTP but different IP address and especially also a different protocol to access the upstream, i.e. https:// instead of http://.
The IP address is the external IP address of the server itself. So it looks for me like you exposing the internal app on port 3000 also directly to the internet.
Only, you then access this application with https:// and not http://. It is very unlikely that the app supports both HTTP and HTTPS on the same port, so it is likely that it should have been http:// and not https:// to access the internal application. This is actually a common problem and the "wrong version number" is a common error message seen with such a broken setup.

Recommendations:

Change proxy_pass https://128.199.21.142:3000/ to proxy_pass http://127.0.0.1:3000, i.e. exactly the same upstream for port 80 http and port 443 https.
Don't expose the internal app to the internet, i.e. make it listen only on 127.0.0.1 and/or block access from the internet using firewall rules.

Thanks a lot... that's exactly what i did trying to fix... working perfectly now... you gave pretty helpful insights... i'll keep in mind the suggestions you gave.. thanks again — Lav Saini, Jul 03 '21 at 09:35

Server domain returning 502 Bad Gateway - Nginx

1 Answers1