504 From Specific Edge Locations

Question

I finally managed to reproduce issues where were seeing from European customers by using my VPN service through Germany.  Everything seems fine from the US and some other European locations.   
  
CloudFront logs are showing the 504's across several Edge locations in Europe, so I don't think this is isolated to one Edge location.  
  
What we are seeing.   
  
Both default and `test.cfm` behaviors are configured the same, except path.    
  
From FRA50-C1:  
  
https://www.photoeye.com/test2.cfm (200) Always a Cache Miss  
  
https://www.photoeye.com/test.cfm (504) After 30 seconds  
  
From PHX50-C1:  
  
https://www.photoeye.com/test2.cfm (200) Always a Cache Miss  
  
https://www.photoeye.com/test.cfm (200) Works as expected  
  
In the first case, if I drop the `test.cfm` behavior, things work as test2.cfm.   
  
We have several other paths that are doing the same exact thing (work at on edge, but not another), and really only seems specific to Europe.

Answer

So testing, I believe I have a solution.   
  
So we have all HTTPS to CloudFront.  Then our custom Origin (which lives outside AWS) had to be HTTP, since the load balancer at the Origin only had the domain we needed to serve on CloudFront. If we did, CloudFront would just redirect to itself.....  
  
https://domain.com --> CloudFront --> https://domain.com --> goto CloudFront instead of origin.   
  
Originally I attempted another origin domain with the origin SSL, but as it thought, CloudFront didn't like the SSL mismatch.   
  
Didn't work.  
  
https://domain.com --> CloudFront --> https://random.domain.com --> goto Origin, but just got 504  
  
Did work, as I took the origin out of SSL  
  
https://domain.com --> CloudFront --> http://random.domain.com --> goto Origin, OK in U.S. and other places, but a not working in Europe.   
  
We had a demo version of the site working under a different CNAME and valid SSL, and I tested successfully in that manner.  
  
https://domain.com --> CloudFront --> https://demo.domain.com --> goto Origin, valid SSL, everything is AWESOME!  
  
I think this is probably somehow related to EU privacy laws. And yes, this isn't how we probably should have configured things, but the SSL limitations on our Origin made it somewhat necessary.   
  
We'll have to get another SSL on our load balance to resolve this, but at least we have a solution.

Answer

So I narrowed things down a bit, if I set all the TTLs to 0, things work, although nothing is cached. Setting the max or default above 0 results in the behavior.   
  
I recreated a new distribution and it's acting the same. Seems like Germany, Italy and France are the main edge locations with issue.

504 From Specific Edge Locations

Relevant content