title: 502 error and unhealthy health status in the target group when using AWS ELB and ACM for https
body: <p>I'm using AWS ELB and ACM to use HTTPS on Node.js but, I have been facing 502 error.<br>
  The health status of the target group for the HTTPS is &quot;unhealthy&quot; which is making me understand I'm doing something wrong around ELB.</p>
  <p>The following is what I did.</p>
  <p><b>[ELB]</b></p>
  <b>VPC</b>: Same VPC with the EC2 instance<br>
  <b>Subnet #1</b>: 10.0.1.0/24: Same subnet with the EC2 instance<br>
  <b>Subnet #2</b>: 10.0.3.0/24: New subnet which was created for this test<br>
  <b>Security group</b>: All traffic for inbound & outbound are opened (for this test purpose)<br>
  <b>Listener_a(http:80)</b>:<br>
  Rule1: <br>
  (If) Host is [example].com OR www.[example].com<br>
  (Then) Redirect to https://www.[example].com:443/#{path}?#{query}<br>
  (path and query are untouched from the default placeholder)<br>
  Status code: HTTP_301<br>
  Rule last: untouched from the default<br>
  <b>Listener_b(https:443)</b>:<br>
  Rule1: <br>
  (If) Host is [example].com<br>
  (Then) Redirect to https://www.[example].com:443/#{path}?#{query}<br>
  (path and query are untouched from the default placeholder)<br>
  Status code: HTTP_301<br>
  Rule last: untouched from the default<br>
  <br>
  <p><b>[Target groups of ELB]</b><p>
  <b> Target group #1</b>:<br>
  [Target type] [Protocol version] [Instance ID] [Name] [Port] [Zone] [Health status]<br>
  Instance HTTP1 [Instance ID of the EC2] testname1 80 us-east-2b healthy <br>
  <b> Target group #2</b>:<br>
  [Target type] [Protocol version] [Instance ID] [Name] [Port] [Zone] [Health status] [Health status details]<br>
  Instance HTTP1 [Instance ID of the EC2] testname2 443 us-east-2b unealthy "Health checks failed"<br>
  <br>
  <p><b>[Summary of ELB log]</b><p>
  <b>type</b>: h2<br>
  <b>target</b>:port: Private IPv4 address of the EC2 instance<br>
  <b>request_processing_time</b>: -1<br>
  <b>target_processing_time</b>: -1<br>
  <b>response_processing_time</b>: -1<br>
  <b>elb_status_code</b>: 502<br>
  <b>target_status_code</b>: -<br>
  <b>request</b>: GET https://www.[example].com:443/HTTP/2.0<br>
  <br>
  <p><b>[Route 53]</b><p>
  [Record name] [Type] [Routing Policy] [Differentiator] [Value/Route traffic to]<br>
  [example].com A Simple - www.[example].com.<br>
  www.[example].com A Simple - dualstack.[DNS name of the ELB].<br>
  [CNAME name of *.[example].com from ACM] CNAME Simple - [CNAME value from ACM]<br>
  [CNAME name of www.[example].com from ACM] CNAME Simple - [CNAME value from ACM]<br>
  [example].com NS Simple - [4 Name Servers added by Route 53]<br>
  [example].com SOA Simple - [Value added by Route 53]<br>
  <br>
  <p><b>[ACM]</b><p>
  [Domain] [Status]<br>
  *.[example].com Success<br>
  [example].com Success<br>
  www.[example].com Success<br>
  <br>
  <p><b>[EC2]</b><p>
  <b>VPC</b>: Same VPC with the ELB (10.0.0.0/16)<br>
  <b>Subnet #1</b>: Same subnet with the one of the subnet assinged to ELB (10.0.1.0/24)<br>
  <b>Public IPv4 address</b>: [ElasticIP assigned]<br>
  <b>Security group</b>: All traffic for inbound & outbound are opened (for this test purpose)<br>
  <br>
  <p><b>[Routing table (same for both subnet)]</b><p>
  [Destination] [Target]<br>
  10.0.0.0/16 local<br>
  0.0.0.0/0 [IGW]<br>
  <br>
  <p><b>[ACLs]</b><p>
  All are allowed for both Inbound and Outbound(for this test purpose).
  <br>
  <p><b>[iptables I ran on EC2]</b><p>
  # iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 8000<br>
  # iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-ports 8443<br>
  <br>
  <p><b>[Node.js code on EC2 (index.js)]</b><p>
  <pre><code>const fs = require('fs');
  const http = require('http');
  const https = require('https');
  
  const express = require('express');
  const app = express();
  const path = require('path');
  
  app.get('/', (req, res) =&gt; {
      res.send(&quot;Hello World!&quot;);
  });
  
  const httpServer = http.createServer(app);
  const httpsServer = https.createServer(app);
  
  httpServer.listen(8000, () =&gt; {
      console.log(&quot;App is listening on port 8000&quot;);
  });
  
  httpsServer.listen(8443, () =&gt; {
      console.log(&quot;App is listening on port 8443&quot;);
  });
  </code></pre>
  <p><b>[Summary of results accessing from browser]</b></p>
  https://www.[example.com]<br> => "502 Bad Gateway"<br>
  http://[example].com<br> => Browser redirect it to https://www.[example].com and returns "502 Bad Gateway"<br>
  [my Elastic IP]<br> => Can see the web page w/o error<br>
  [Public IPv4 DNS of the EC2 instance]<br> => Can see the web page w/o error<br>
  [DNS name]<br> => Can see the web page w/o error<br>
  <br>
  <p><b>[Summary of results accessing from EC2 command line with curl]</b></p>
  http://www.[example].com<br> => 301 Moved Permanently<br>
  https://www.[example].com<br> => 502 Bad Gateway<br>
  <br>
  I tried to figure out what is wrong based on the following documents but, so far, no luck.<br>
  <br>
  https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-access-logs.html#enable-access-logging<br>
  https://docs.aws.amazon.com/elasticloadbalancing/latest/application/target-group-health-checks.html<br>
  https://aws.amazon.com/premiumsupport/knowledge-center/elb-fix-failing-health-checks-alb/<br>
  https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-troubleshooting.html<br>
  https://aws.amazon.com/premiumsupport/knowledge-center/troubleshoot-unhealthy-checks-ecs/<br>
  <br>
  If anyone could provide me with your insight about what I am missing/doing wrong, it would be great. Please let me know if there is any other information needed.<br>
  Thank you!<br>
  <br>
  <p><b>[Additional edits (8/21/2022)]</b></p>
  As it looked similar to what was discussed on this thread (https://stackoverflow.com/questions/60738575/target-group-443-gives-health-checks-failed-with-these-codes-502?rq=1), I just tried changing the Health check protocol for the target group of HTTPS to use HTTP; however, the results (unhealthy) were the same.<br>
  <br>