# 502 / bad gateway errors **URL:** \ **Category:** General\ **Created:** [May 10, 2021, 5:14pm UTC](https://community.fly.io/t/502-bad-gateway-errors/1427 "2021-05-10T17:14:22Z")\ **Posts on this page:** 17\ **Page:** 1
**Author:** ![davidhodge](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/davidhodge/32/9908_2.png) [@davidhodge](https://community.fly.io/u/davidhodge)\ **Post date:** [May 10, 2021, 5:14pm UTC](https://community.fly.io/t/502-bad-gateway-errors/1427/1 "2021-05-10T17:14:22Z")
hello Fly friends, it’s totally possible I messed something up here, but it appears my simple Fly Nginx proxies are giving me 502 errors with “tlsv1 alert access denied”. This started to happen as of Friday. See nikola-proxy for an example, though it happens with all my proxy service. I assumed at first the 502s were coming via the service I was proxying to, but it looks like it might be happening in Fly. I’m working now on eliminating variables, etc, but when I sidestep the proxies, the 502 errors go away. This leads me to believe it might be a fly thing. Any ideas? Thank you! ---
**Author:** ![jerome](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/jerome/32/17_2.png) [@jerome](https://community.fly.io/u/jerome)\ **Post date:** [May 10, 2021, 5:19pm UTC](https://community.fly.io/t/502-bad-gateway-errors/1427/2 "2021-05-10T17:19:30Z")
Looking into this. It might be due to the fact that the app is old-ish and it was before we issued a fix for “disappearing” certificates. I’ll have you back in no time. ---
**Author:** ![davidhodge](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/davidhodge/32/9908_2.png) [@davidhodge](https://community.fly.io/u/davidhodge)\ **Post date:** [May 10, 2021, 5:20pm UTC](https://community.fly.io/t/502-bad-gateway-errors/1427/3 "2021-05-10T17:20:01Z")
okay thank you! I also re-deployed just now to see if that would do anything. ---
**Author:** ![jerome](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/jerome/32/17_2.png) [@jerome](https://community.fly.io/u/jerome)\ **Post date:** [May 10, 2021, 5:22pm UTC](https://community.fly.io/t/502-bad-gateway-errors/1427/4 "2021-05-10T17:22:55Z")
The 502 is not from us. Looks like a nginx 502. I’ve “revived” your certificate. Handshakes are working on my end. ---
**Author:** ![davidhodge](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/davidhodge/32/9908_2.png) [@davidhodge](https://community.fly.io/u/davidhodge)\ **Post date:** [May 10, 2021, 5:24pm UTC](https://community.fly.io/t/502-bad-gateway-errors/1427/5 "2021-05-10T17:24:59Z")
Okay thank you, I will keep digging. Out of my depth re:nginx, but it’s such a simple config I’m surprised it broke like this! ---
**Author:** ![jerome](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/jerome/32/17_2.png) [@jerome](https://community.fly.io/u/jerome)\ **Post date:** [May 10, 2021, 5:43pm UTC](https://community.fly.io/t/502-bad-gateway-errors/1427/6 "2021-05-10T17:43:46Z")
Looks like you’re back? What was the issue? ---
**Author:** ![davidhodge](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/davidhodge/32/9908_2.png) [@davidhodge](https://community.fly.io/u/davidhodge)\ **Post date:** [May 10, 2021, 5:49pm UTC](https://community.fly.io/t/502-bad-gateway-errors/1427/7 "2021-05-10T17:49:48Z")
I don’t think I’ve figured out the issue unfortunately. Still having 502s ☹ Not sure why Nginx is whining. And sadly don’t have the logging I need to debug this, so I’m working on that now. ---
**Author:** ![jsierles](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/jsierles/32/595_2.png) [@jsierles](https://community.fly.io/u/jsierles)\ **Post date:** [May 10, 2021, 5:55pm UTC](https://community.fly.io/t/502-bad-gateway-errors/1427/8 "2021-05-10T17:55:35Z")
Just a random guess here, but I’ve seen this error before with proxies when the origin and proxy have mismatched TLS settings. These were either due to unsupported TLS versions on either side, or an incorrect SNI hostname or Host header setting. ---
**Author:** ![davidhodge](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/davidhodge/32/9908_2.png) [@davidhodge](https://community.fly.io/u/davidhodge)\ **Post date:** [May 10, 2021, 5:58pm UTC](https://community.fly.io/t/502-bad-gateway-errors/1427/9 "2021-05-10T17:58:01Z")
I will look in to that, thank you! Much to learn on this front. FWIW, it looks like I do have some useful logging here actually. Nginx giving lots of “[error] 515#515: \*77695 peer closed connection in SSL handshake (104: Connection reset by peer) while SSL handshaking to upstream, client:” ---
**Author:** ![jerome](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/jerome/32/17_2.png) [@jerome](https://community.fly.io/u/jerome)\ **Post date:** [May 10, 2021, 6:06pm UTC](https://community.fly.io/t/502-bad-gateway-errors/1427/10 "2021-05-10T18:06:44Z")
I’m getting a 404 visiting your app’s `/` path. I do see a lot of 502s in your metrics though. Can you try deploying the app? I wonder if nginx is “stuck” somehow. ---
**Author:** ![davidhodge](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/davidhodge/32/9908_2.png) [@davidhodge](https://community.fly.io/u/davidhodge)\ **Post date:** [May 10, 2021, 6:08pm UTC](https://community.fly.io/t/502-bad-gateway-errors/1427/11 "2021-05-10T18:08:32Z")
not sure about the 404s. Probably because the / path on the server I’m proxying to I think 404s? Re-deploying now. ---
**Author:** ![jerome](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/jerome/32/17_2.png) [@jerome](https://community.fly.io/u/jerome)\ **Post date:** [May 10, 2021, 6:17pm UTC](https://community.fly.io/t/502-bad-gateway-errors/1427/12 "2021-05-10T18:17:09Z")
Looks like the upstream you’re trying to reach has an invalid cert. ![image](https://global.discourse-cdn.com/fly1/original/3X/6/b/6b1d470f8b9a5503d9d5f04b507910cee1293a2f.jpeg) Unless your nginx config is configured to trust that certificate or to ignore unverified peers, then it won’t be able to communicate with the upstream. ---
**Author:** ![davidhodge](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/davidhodge/32/9908_2.png) [@davidhodge](https://community.fly.io/u/davidhodge)\ **Post date:** [May 10, 2021, 6:31pm UTC](https://community.fly.io/t/502-bad-gateway-errors/1427/13 "2021-05-10T18:31:34Z")
Oh wow! I’ll investigate that. For my future learnings, how did you figure that out? Thank you ---
**Author:** ![jerome](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/jerome/32/17_2.png) [@jerome](https://community.fly.io/u/jerome)\ **Post date:** [May 10, 2021, 6:36pm UTC](https://community.fly.io/t/502-bad-gateway-errors/1427/14 "2021-05-10T18:36:24Z")
Looking at your logs 🙂. The logs from nginx shows which upstream they’ve encountered the error from: e.g. ```auto 2021/05/10 18:14:07 [error] 515#515: *155052 peer closed connection in SSL handshake (104: Connection reset by peer) while SSL handshaking to upstream, client: , server: proxy.nikolaapp.com, request: "GET /api/1/vehicles// HTTP/1.1", upstream: "https://:443/api/1/vehicles//", host: "proxy.nikolaapp.com" ``` so I checked `:433` and the certificate seemed invalid. I’m not entirely sure if you put an IP in your config or if nginx resolved it to that IP and shows the latter in the logs though 🤔 You might want to use a hostname there so it sends a SNI, perhaps you’ll get a proper cert? Maybe you’re already doing that. If you don’t mind sharing your nginx config, I might be able to help a bit more! ---
**Author:** ![davidhodge](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/davidhodge/32/9908_2.png) [@davidhodge](https://community.fly.io/u/davidhodge)\ **Post date:** [May 10, 2021, 6:51pm UTC](https://community.fly.io/t/502-bad-gateway-errors/1427/15 "2021-05-10T18:51:17Z")
emailed you my config, thank you. I believe I am using a hostname. I wonder if perhaps the upstream server is sometimes using a valid cert and sometimes using an invalid one. also, thank you so so much for your help here. ---
**Author:** ![davidhodge](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/davidhodge/32/9908_2.png) [@davidhodge](https://community.fly.io/u/davidhodge)\ **Post date:** [May 10, 2021, 7:02pm UTC](https://community.fly.io/t/502-bad-gateway-errors/1427/16 "2021-05-10T19:02:01Z")
looks like there are a bunch came records linked to each other. I’m going to try to deploy with the last one in the chain. ---
**Author:** ![davidhodge](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/davidhodge/32/9908_2.png) [@davidhodge](https://community.fly.io/u/davidhodge)\ **Post date:** [May 10, 2021, 7:46pm UTC](https://community.fly.io/t/502-bad-gateway-errors/1427/17 "2021-05-10T19:46:41Z")
Jerome and I figured it out. Unsurprisingly, it was my fault! Thanks for your help everyone!