502 ERROR The request could not be satisfied. CloudFront wasn't able to connect to the origin.
CloudFront could not get a valid response from the origin
Seen in AWS CloudFront
CloudFront reached for the origin but couldn't complete a usable connection, most often a TLS problem between CloudFront and the origin.
Common causes
- The origin's certificate is expired, self-signed, missing intermediates, or doesn't match the origin domain name.
- Origin protocol policy or ports do not match what the origin listens on (e.g. HTTPS only to an HTTP-only origin).
- The origin domain name does not resolve in public DNS.
- The origin closed the connection or returned an invalid response.
How to fix it
- Test the origin hostname directly and fix its certificate and chain.
- Check the distribution's origin domain, protocol policy and HTTP/HTTPS ports.
- Confirm the origin domain resolves publicly.
Got a different message? Paste it into the error explainer.
Related errors
- Error 525: SSL handshake failed · Cloudflare could not complete TLS with your origin
- Error 526: Invalid SSL certificate · Cloudflare doesn't trust your origin's certificate
- 421 Misdirected Request · The request reached a server that cannot answer for this hostname
- 502 Bad Gateway · The proxy got a bad response from the server behind it
- 503 Service Unavailable · The server is temporarily unable to handle requests
- 504 Gateway Timeout · The server behind the proxy took too long
- Error 520: Web server is returning an unknown error · Cloudflare got an empty or invalid response
- Error 521: Web server is down · Cloudflare could not connect to your origin
- Error 522: Connection timed out · Cloudflare timed out connecting to your origin
- 429 Too Many Requests · You've hit a rate limit
- 400 Bad Request · The server could not understand the request
- 401 Unauthorized · The request needs valid credentials