title: Getting Error 522 with CloudFlare + AWS Application LoadBalancer
body: <p>Getting Error 522 or 521, when accessing 80 or 443 port from ALB link its working (for 443 browser shows warning i.e because ALB and SSL domain is different)</p>
  <p><strong>AWS Config.</strong></p>
  <ol>
  <li>Created Custom VPC with 1 public subnet and 1 private subnet</li>
  <li>Created AutoScaling Group</li>
  <li>Created Load Balancer (two listener for http and https forwording to traget group ) and target group (two targets pointing to Ec2 Instance on port 80 and 443 for heathcheck) -&gt; health check is passing.</li>
  <li>Launched Ec2 instance in private subnet (no public ip), instance can only be access by application load balancer security group.</li>
  </ol>
  <p><strong>Ec2 and Apache2 Config.</strong></p>
  <ol start="5">
  <li><p>Enabled SSL in apache2</p>
  </li>
  <li><p>Open port 443 in instance, Security Group of ALB and access port 80 (http) and 443 (https)</p>
  </li>
  <li><p>For SSL followed article <a href="https://www.digitalocean.com/community/tutorials/how-to-create-a-self-signed-ssl-certificate-for-apache-in-ubuntu-18-04" rel="nofollow noreferrer">https://www.digitalocean.com/community/tutorials/how-to-create-a-self-signed-ssl-certificate-for-apache-in-ubuntu-18-04</a></p>
  </li>
  </ol>
  <p><strong>Generated SSL Certificate from CloudFlare</strong></p>
  <ol start="8">
  <li><p>SSL/TLS -&gt; Origin Server -&gt; Generated RSA certificate</p>
  </li>
  <li><p>Imported SSL certificate to AWS ACM</p>
  </li>
  <li><p>Attached ACM SSL certificate to Loadbalancer HTTPS Listener</p>
  </li>
  <li><p>Also create AWS ACM SSL certificate and validated with DNS for testing tried both ssl certificate - didn't worked</p>
  </li>
  </ol>
  <p><strong>Subdomain and ALB link</strong></p>
  <ol start="12">
  <li><p>Created DNS CNAME entry in CloudFlare</p>
  </li>
  <li><p>Added subdomain which pointing to ALB link. (tried with proxy and DNS only)</p>
  </li>
  <li><p><strong>Your SSL/TLS encryption mode is Full</strong></p>
  </li>
  <li><p><strong>Always Use HTTPS: ON</strong></p>
  </li>
  </ol>
  <p>When hitting subdomain in normal window (browser) its getting 522 and in incognito mode for the first time it is working but after that not.</p>
  <p>When making curl request to <a href="https://subdomain.domain.com" rel="nofollow noreferrer">https://subdomain.domain.com</a> always working</p>
  <p>Created extact duplicate instance in Public subnet and linked with another subdomain (created in cloudflare) just for testing -&gt; working properly.</p>
  <p>Also tried by adding separate target group for port 443 (HTTPS) -&gt; in this traget group health check is getting failed whereas same working in other target group which for port 80 (http)</p>
  <p>I'm not getting how to resolve this issue, please help!
  Thank you.
  Please Help!</p>