SteadyNode

AWS CloudFront · HTTP 502

CloudFront 502: Origin TLS or Response Mismatch

Trace CloudFront 502 to an origin TLS mismatch, invalid HTTP response, or unreachable origin. Check distribution origin settings and origin logs.

Origin / TLS Configuration

Decode a CDN or gateway error

Paste a captured HTTP response or enter a status and headers. Only the status and response headers are sent; common credential headers are filtered first.

Supports raw headers, full HTTP responses, JSON with status/statusCode and headers, cURL -v/-i response output, and HAR exports. HAR selects a server error first. cURL commands are never executed; request headers, response bodies, and common credential headers are excluded.

Diagnostic report

Error code / name

AWS_CLOUDFRONT_502

Fault domain

Origin / TLS Configuration

Why it happened

CloudFront could not establish a valid origin exchange. A certificate hostname mismatch, unsupported TLS setup, premature close, or malformed origin response can produce a 502.

Actionable fixes

  1. Use the x-amz-cf-id and distribution logs to identify the failing origin and request time.
  2. Confirm the origin certificate covers the configured origin hostname and serves a complete trusted chain.
  3. Verify the origin returns valid HTTP headers and that its security policy permits CloudFront connections.

Why this error happened

CloudFront could not establish a valid origin exchange. A certificate hostname mismatch, unsupported TLS setup, premature close, or malformed origin response can produce a 502.

Actionable fixes

  1. Use the x-amz-cf-id and distribution logs to identify the failing origin and request time.
  2. Confirm the origin certificate covers the configured origin hostname and serves a complete trusted chain.
  3. Verify the origin returns valid HTTP headers and that its security policy permits CloudFront connections.

Network failure point

Client -> CloudFront POP -> origin TLS/HTTP validation -> certificate or response mismatch -> X

Verify origin directly via CLI

openssl s_client -connect ORIGIN_HOST:443 -servername ORIGIN_HOST -verify_return_error -showcerts </dev/null

Configuration fix

cloudfront.tfhcl
custom_origin_config {
  origin_protocol_policy = "https-only"
  origin_ssl_protocols   = ["TLSv1.2"]
  https_port             = 443
}

Catch this failure before it becomes an outage

SteadyNode's TLS Chain Debugger validates the public certificate and its regional HTTP checks detect 502 responses, helping isolate origin TLS regressions from edge faults.

No credit card required.

Start for free

Frequently asked questions

Can a CloudFront origin certificate cause 502?

Yes. CloudFront can return 502 when the origin certificate or TLS negotiation does not match the configured origin connection.

What does x-amz-cf-id help identify?

It is a request identifier that helps correlate a viewer response with CloudFront and origin-side diagnostics.

More CDN and gateway error guides

Cloudflare

Vercel and Netlify

AWS CloudFront and ALB

Fastly

Heroku and Render

Nginx and Envoy