CloudFront wasn't able to connect to the origin
Asked Answered
M

7

15

I had set up Cloudfront correctly over http. It fetched data from my website (dev.pie.video) fine. I'm now moving to https. Things are working fine at https://dev.pie.video but Cloudfront is unable to server any content. For instance https://dev.pie.video/favicon-96x96.png works but https://d1mbpc40mdbs3p.cloudfront.net/favicon-96x96.png fails with status 502, even though my Cloudfront distribution d1mbpc40mdbs3p points to dev.pie.video.

More details if that's helpful:

  • d1mbpc40mdbs3p.cloudfront.net uses the default CloudFront Certificate for https
  • the cloudfront distribution's origin is set to work over SSL and TLS, and to use the viewer's protocol.

===== Edit 1 =====

screenshots of the cloudfront settings:

General: enter image description here

Origin:

enter image description here

Behaviors:

enter image description here enter image description here

==== Edit 2 ====

if that's helpful, the logs I'm getting from cloudfront look like

<timestamp> SFO20   924 96.90.217.130   GET d1mbpc40mdbs3p.cloudfront.net   /favicon-96x96.png  502 -   <someInfoOnTheClientBrowser>    2   -   Error   poZyhl63JNGFk8dIIjCluGDm4dxF8EdMZFhjg82NgHGPNqcmx6ArHA==    d1mbpc40mdbs3p.cloudfront.net   https   494 0.002   -   TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 Error   HTTP/1.1
Midship answered 8/8, 2016 at 22:55 Comment(3)
Try changing Viewers protocol policy to https only. And invalidate cacheLattie
I've done that and will let you know once the settings have been deployed. I've also added details on the logs I'm getting in case that's relevant.Midship
Ok you are making CloudFront distribution to support the newer TLS versions? Older distributions use SSLv3 by default. Check SSLv3 in the settingsLattie
I
16

Your origin server is incorrectly configured for SSL. CloudFront requires a valid configuration, and may be more stringent than some browsers -- so a green lock in the browser doesn't necessarily mean your SSL setup is complete and universally compatible with all clients.

$ true | openssl s_client -connect dev.pie.video:443 -showcerts
CONNECTED(00000003)
depth=0 OU = Domain Control Validated, CN = dev.pie.video
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 OU = Domain Control Validated, CN = dev.pie.video
verify error:num=27:certificate not trusted
verify return:1
depth=0 OU = Domain Control Validated, CN = dev.pie.video
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
 0 s:/OU=Domain Control Validated/CN=dev.pie.video
   i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certs.godaddy.com/repository//CN=Go Daddy Secure Certificate Authority - G2
-----BEGIN CERTIFICATE-----
MIIFMzCCBBugAwIBAgIJAL96wtFpu1ZpMA0GCSqGSIb3DQEBCwUAMIG0MQswCQYD
VQQGEwJVUzEQMA4GA1UECBMHQXJpem9uYTETMBEGA1UEBxMKU2NvdHRzZGFsZTEa
MBgGA1UEChMRR29EYWRkeS5jb20sIEluYy4xLTArBgNVBAsTJGh0dHA6Ly9jZXJ0
cy5nb2RhZGR5LmNvbS9yZXBvc2l0b3J5LzEzMDEGA1UEAxMqR28gRGFkZHkgU2Vj
dXJlIENlcnRpZmljYXRlIEF1dGhvcml0eSAtIEcyMB4XDTE2MDgwODE4MzQ0MFoX
DTE3MDgwODE4MzQ0MFowOzEhMB8GA1UECxMYRG9tYWluIENvbnRyb2wgVmFsaWRh
dGVkMRYwFAYDVQQDEw1kZXYucGllLnZpZGVvMIIBIjANBgkqhkiG9w0BAQEFAAOC
AQ8AMIIBCgKCAQEAz/wT5j/zHKzmt3oRvst74Knqxc0pl3sp5imUJ7UegoxcTISm
xJC5qQiDsD0U08kAFxvXDd91jlozh4QDcfLE8N7X9fsxC7OW2pDv3ks/LO7tiCxn
gNmxjvYvOQ/vASrLHIal+oGWJNdBMB1eckV4xHCeBDDEizDneq/qvjN0M0k5hQ+/
qk7RjVhJUmFAfvhXpxXaCbVDq1d3V1iRBo3oP3SGV++bj/m55QPFfKCZqGPTiM5G
c9+8ru16EVCpvs0wCWBVxjTiOCGtrMLgvp9LOs8AN369Yk/3AynpgAI0DDhb5y8I
KEuCdbUaIg5Zo029iZz4nWRsZFd5CSwgX8tZNQIDAQABo4IBvjCCAbowDAYDVR0T
AQH/BAIwADAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDgYDVR0PAQH/
BAQDAgWgMDcGA1UdHwQwMC4wLKAqoCiGJmh0dHA6Ly9jcmwuZ29kYWRkeS5jb20v
Z2RpZzJzMS0yODIuY3JsMF0GA1UdIARWMFQwSAYLYIZIAYb9bQEHFwEwOTA3Bggr
BgEFBQcCARYraHR0cDovL2NlcnRpZmljYXRlcy5nb2RhZGR5LmNvbS9yZXBvc2l0
b3J5LzAIBgZngQwBAgEwdgYIKwYBBQUHAQEEajBoMCQGCCsGAQUFBzABhhhodHRw
Oi8vb2NzcC5nb2RhZGR5LmNvbS8wQAYIKwYBBQUHMAKGNGh0dHA6Ly9jZXJ0aWZp
Y2F0ZXMuZ29kYWRkeS5jb20vcmVwb3NpdG9yeS9nZGlnMi5jcnQwHwYDVR0jBBgw
FoAUQMK9J47MNIMwojPX+2yz8LQsgM4wKwYDVR0RBCQwIoINZGV2LnBpZS52aWRl
b4IRd3d3LmRldi5waWUudmlkZW8wHQYDVR0OBBYEFEPW+uDOOtZfUEdXuBs+960C
zQRKMA0GCSqGSIb3DQEBCwUAA4IBAQBLkLYJEc9E+IGv6pXaPCcYowJfji651Ju6
3DNzGXdyWfOXG+UVCMtPZuC9J66dID4Rc7HWzLveTPEI32z4IgtSjvRwRk9YyWVx
uCOpsP3e/Vgriwg5ds4NyrelQfshA3KaiTLohuiVEOBZgZgIwBEmwR2ZNFuL375E
uEn909zF9+sGkTbFnMm1zlqB2oh2UlSkUT3mj009vWF416W6kZQdFFFEmaI8uSmo
+Thd8HSxQytzWvB3dR4lCteiC09lkQPHU5t10tPgK9BtkLv05ICQQoDhFJmLeAcC
WNEmCcDnSHPxXjPi8kcyM6aqNofL1D0e1pYYvcpYQQDayWdY3tUh
-----END CERTIFICATE-----
---
Server certificate
subject=/OU=Domain Control Validated/CN=dev.pie.video
issuer=/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certs.godaddy.com/repository//CN=Go Daddy Secure Certificate Authority - G2
---
No client certificate CA names sent
---
SSL handshake has read 2010 bytes and written 431 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES128-GCM-SHA256
Server public key is 2048 bit
...clipped...

Your certificate is signed by "Go Daddy Secure Certificate Authority - G2" which is an intermediate certificate (not a root), and you don't have that intermediate certificate installed on your server -- so CloudFront reports that it is "unable" to connect, when in fact it is more accurately "unwilling" to connect, as a security precaution, because it can't verify the validity of your SSL certificate. You should see these as SSL negotiation failures in your web server's log. The connection itself is working, but CloudFront considers it invalid, and therefore unsafe to use, due to the trust issue.

Caution

If the origin server returns an expired certificate, an invalid certificate or a self-signed certificate, or if the origin server returns the certificate chain in the wrong order, CloudFront drops the TCP connection, returns HTTP error code 502, and sets the X-Cache header to Error from cloudfront.

http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/SecureConnections.html

Add your intermediate certificate to your server configuration, and you should be set. This should have been bundled with the cert when you downloaded it, but if not, it can be obtained from your CA, Go Daddy in this case.

This is not a limitation specific to Go Daddy certificates. All CAs that follow standard practice use intermediate certificates to establish a chain of trust back to a trusted root.

See also:

https://www.godaddy.com/help/what-is-an-intermediate-certificate-868

https://certs.godaddy.com/repository

Incurrence answered 9/8, 2016 at 2:21 Comment(0)
V
2

In case it helps ( I am new to Lightsail )

I had a similar issue, when creating a Lightsail Distribution.

TLDR: try setting Origin protocol policy to be HTTP (since your origin indeed is only able to serve up HTTP unless you also add the SSL cert there)


DETAIL

I followed the documentation, in particular https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-creating-content-delivery-network-distribution#distribution-origin-protocol-policy

I created:

  • Lightsail instance (PHP bitnami image)
  • configured Distribution for a dynamic site, and to use HTTPS, by creating a SSL cert
  • created a DNS zone
  • configured domain to point to the nameservers of that DNS zone
  • configured A + CNAME records in the DNS records in DNS zone, to point to the distribution

error: browser shows 502 error page

The problem I had was that "Origin protocol policy" was set to HTTPS only, although the Lightsail instance could only serve up HTTP. I changed "Original protocol policy" to HTTP and then the page serves OK (as HTTPS).

It seems that SSL cert and HTTPS can be handled entirely by the Distribution, and do not need to be configured on the Instance (provided you set "Origin protocol policy" to HTTP).

So a crude high level picture, looks like:

browser <-- https --> Distribution <-- http --> Instance

Of course, the downside is that my Lightsail instance is serving pages as HTTP, to anyone who knows its static IP address...

Visional answered 28/8, 2021 at 18:55 Comment(0)
A
1
TLDR

My domain was sub.dev.example.com so having just dev.example.com in my certificate was not sufficient, also needed *.dev.example.com.


Domain Expansion

Setting up these services can be a huge pain. In my case, I had another app that was already setup and I was trying to replicate its configuration for a new app and serve it through Cloudfront. But the obnoxious error did not specifically tell me where in the chain the issue was occurring. I checked the certificates as suggested by @michel-sqlbot's answer but they seemed perfectly fine.

I ended up going through this AWS How do I troubleshoot a 502: "The request could not be satisfied" error from CloudFront? re:Post and trying each command. I couldn't get the first command but the second openssl s_client -connect DOMAIN:443 -servername SERVER_DOMAIN | openssl x509 -text | grep -E '(CN|Alternative)' -A 2 command showed there was a different output for the X509v3 Subject Alternative Name section. This indicated there was a difference in the fully qualified domain names my certificate was attached to. So, I ended up requesting a new AWS Certificate Manager public certificate and made sure to include the missing domain.

Both of these instead of just the first one:

dev.example.com
*.dev.example.com

That fixed it.

Astrobiology answered 2/1, 2024 at 18:41 Comment(0)
F
0

I got the same issue. I did below steps:

  1. Looked at ALB Lister tab and checked for the port of 443.
  2. There were two certs out of which one was expired and ALB was pointing to newer one but still we were getting 502 error.
  3. AWS support suggested to remove the expired from 443 listener.

Thanks Santosh Garole

Fortnightly answered 6/9, 2021 at 4:52 Comment(0)
U
0

I had similar issue I fixed by not selecting website endpoint when selecting origin even though it is prompted to use it.

In my case even cloudfront ssl certificate was not working however I was able to connect through website endpoint without cloudfront.

Also I needed to set default root object to index.html in order to get it working.

Underfur answered 1/2, 2023 at 20:16 Comment(0)
K
0

I came here with a slightly different issue.

My issue was that my ec2 instance was supporting HTTPS with a self-signed certificate and CloudFront was not happy with the certificate.

At first glance, it looked like CloudFront is not happy if the origin is running with self-signed certificates. However, all the documentation says that CloudFront does support origin running self-signed certificates.

Also, CloudFront logs and the error message itself do not provide any clue about why CloudFront is unable to connect to origin. Even in CloudFront logs recovered from S3 bucket, there is no additional information about the failure. It just says "502 Bad Gateway" "Unable to connect to origin". It would have been much more helpful if the log provided more details - for example if it mentioned a reason like "Protocol too weak - minimum TLS1.2" or "Domain name mismatch" or "Certificate should be at least RSA2048".

Getting to the actual issue: The CN field in my self-signed certificate was wrong.

Root cause: There is a Java keytool which is able to make public-private key pairs. However, its seems to be designed with "personal certificates" in mind. So, it specifically asks for "Your first name, last name" and then stores it as the CN field. The Common Name field is supposed to be the Fully Qualified Domain Name for web site certificates.

Fix: Check if the CN field of your certificate is right. If not, regenerate the certificate with the right CN and redeploy.

Katabasis answered 29/3, 2024 at 20:29 Comment(0)
V
-1

I've had this issue when using CloudFront (Amazon) on top of CloudFlare (different company). They surely have their https certificates correct?

Didn't get to the bottom of it and I just switched back to http for the origin. It was just images for a stupid ebay store and I was really only using CloudFront to obfuscate the domain underneath (because people steal image URLs on ebay).

I added a query string parameter ?a=1 and it worked, ?a=2 failed, ?a=3 worked, ?a=4 worked and ?a=8 failed again. So there was something funky going on with either CloudFront's

Still not sure what was going on but invalidation didn't fix it, neither would have I expected it to since I pass through query strings and changing a did not make it always work.

if you get the problem try adding a nonsense parameter and incrementing it several times and observe the results.

Vasya answered 31/10, 2017 at 2:57 Comment(0)

© 2022 - 2025 — McMap. All rights reserved.