Help us improve the AWS re:Post Knowledge Center by sharing your feedback in a brief survey. Your input can influence how we create and update our content to better support your AWS journey.
How do I resolve the "CloudFront wasn't able to connect to the origin" error?
I want to troubleshoot why my users receive the "CloudFront wasn't able to connect to the origin" error.
Resolution
"HTTP 502" errors from Amazon CloudFront might occur for the following reasons:
- There's an SSL/TLS negotiation failure because the origin uses SSL/TLS protocols and ciphers that CloudFront doesn't support.
- There's an SSL/TLS negotiation failure because the SSL certificate on the origin expired, isn't valid, or is self-signed. Or, the certificate chain isn't in the correct order.
- There's a host header mismatch in the SSL/TLS negotiation between your CloudFront distribution and the custom origin.
- The custom origin doesn't respond on the ports that you specified in the origin settings of the CloudFront distribution.
- The custom origin ends the connection to CloudFront too quickly.
- The origin isn't publicly resolvable. If you receive a "NonS3OriginDnsError" error message, then there's a DNS configuration issue that doesn't allow CloudFront to connect to the origin.
For information about how to troubleshoot these issues, see HTTP 502 status code (Bad Gateway).
Related information
Troubleshooting error response status codes in CloudFront
How do I troubleshoot a 502 "The request could not be satisfied" error in CloudFront?
- Language
- English
Concerning "There's a host header mismatch in the SSL negotiation between your CloudFront distribution and the custom origin.". This happens if the origin domain as api-gateway.example.com is not the same as the domain where cloudfront is accessed as example.com. To fix the error in that case do the following: CloudFront -> Distribution -> Behaviors, open the behavior for edit., under "Origin request policy - optional" select "AllViewerExceptHostHeader". Save and wait some time for the changes to apply. I do not remember how long it took. Could be 1 minute or 15 minutes.
Thank you for your comment. We'll review and update the Knowledge Center article as needed.
@David your hint saved my day...
