Koki
Koki

Reputation: 149

502 error and unhealthy health status in the target group when using AWS ELB and ACM for https

I'm using AWS ELB and ACM to use HTTPS on Node.js but, I have been facing 502 error.
The health status of the target group for the HTTPS is "unhealthy" which is making me understand I'm doing something wrong around ELB.

The following is what I did.

[ELB]

VPC: Same VPC with the EC2 instance
Subnet #1: 10.0.1.0/24: Same subnet with the EC2 instance
Subnet #2: 10.0.3.0/24: New subnet which was created for this test
Security group: All traffic for inbound & outbound are opened (for this test purpose)
Listener_a(http:80):
Rule1:
(If) Host is [example].com OR www.[example].com
(Then) Redirect to https://www.[example].com:443/#{path}?#{query}
(path and query are untouched from the default placeholder)
Status code: HTTP_301
Rule last: untouched from the default
Listener_b(https:443):
Rule1:
(If) Host is [example].com
(Then) Redirect to https://www.[example].com:443/#{path}?#{query}
(path and query are untouched from the default placeholder)
Status code: HTTP_301
Rule last: untouched from the default

[Target groups of ELB]

Target group #1:
[Target type] [Protocol version] [Instance ID] [Name] [Port] [Zone] [Health status]
Instance HTTP1 [Instance ID of the EC2] testname1 80 us-east-2b healthy
Target group #2:
[Target type] [Protocol version] [Instance ID] [Name] [Port] [Zone] [Health status] [Health status details]
Instance HTTP1 [Instance ID of the EC2] testname2 443 us-east-2b unealthy "Health checks failed"

[Summary of ELB log]

type: h2
target:port: Private IPv4 address of the EC2 instance
request_processing_time: -1
target_processing_time: -1
response_processing_time: -1
elb_status_code: 502
target_status_code: -
request: GET https://www.[example].com:443/HTTP/2.0

[Route 53]

[Record name] [Type] [Routing Policy] [Differentiator] [Value/Route traffic to]
[example].com A Simple - www.[example].com.
www.[example].com A Simple - dualstack.[DNS name of the ELB].
[CNAME name of *.[example].com from ACM] CNAME Simple - [CNAME value from ACM]
[CNAME name of www.[example].com from ACM] CNAME Simple - [CNAME value from ACM]
[example].com NS Simple - [4 Name Servers added by Route 53]
[example].com SOA Simple - [Value added by Route 53]

[ACM]

[Domain] [Status]
*.[example].com Success
[example].com Success
www.[example].com Success

[EC2]

VPC: Same VPC with the ELB (10.0.0.0/16)
Subnet #1: Same subnet with the one of the subnet assinged to ELB (10.0.1.0/24)
Public IPv4 address: [ElasticIP assigned]
Security group: All traffic for inbound & outbound are opened (for this test purpose)

[Routing table (same for both subnet)]

[Destination] [Target]
10.0.0.0/16 local
0.0.0.0/0 [IGW]

[ACLs]

All are allowed for both Inbound and Outbound(for this test purpose).

[iptables I ran on EC2]

# iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 8000
# iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-ports 8443

[Node.js code on EC2 (index.js)]

const fs = require('fs');
const http = require('http');
const https = require('https');

const express = require('express');
const app = express();
const path = require('path');

app.get('/', (req, res) => {
    res.send("Hello World!");
});

const httpServer = http.createServer(app);
const httpsServer = https.createServer(app);

httpServer.listen(8000, () => {
    console.log("App is listening on port 8000");
});

httpsServer.listen(8443, () => {
    console.log("App is listening on port 8443");
});

[Summary of results accessing from browser]

https://www.[example.com]
=> "502 Bad Gateway"
http://[example].com
=> Browser redirect it to https://www.[example].com and returns "502 Bad Gateway"
[my Elastic IP]
=> Can see the web page w/o error
[Public IPv4 DNS of the EC2 instance]
=> Can see the web page w/o error
[DNS name]
=> Can see the web page w/o error

[Summary of results accessing from EC2 command line with curl]

http://www.[example].com
=> 301 Moved Permanently
https://www.[example].com
=> 502 Bad Gateway

I tried to figure out what is wrong based on the following documents but, so far, no luck.

https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-access-logs.html#enable-access-logging
https://docs.aws.amazon.com/elasticloadbalancing/latest/application/target-group-health-checks.html
https://aws.amazon.com/premiumsupport/knowledge-center/elb-fix-failing-health-checks-alb/
https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-troubleshooting.html
https://aws.amazon.com/premiumsupport/knowledge-center/troubleshoot-unhealthy-checks-ecs/

If anyone could provide me with your insight about what I am missing/doing wrong, it would be great. Please let me know if there is any other information needed.
Thank you!

[Additional edits (8/21/2022)]

As it looked similar to what was discussed on this thread (https://stackoverflow.com/questions/60738575/target-group-443-gives-health-checks-failed-with-these-codes-502?rq=1), I just tried changing the Health check protocol for the target group of HTTPS to use HTTP; however, the results (unhealthy) were the same.

Upvotes: 1

Views: 2451

Answers (1)

Koki
Koki

Reputation: 149

Thanks to the comment from Mark, I updated it as follows and everything is working perfectly, now.

[Target groups of ELB]

Delete the target group for HTTPS and just keep the one for HTTP only.

[ELB]

Update the listener for HTTPS to forward to the target group for HTTP (it was originally forwarding to the target group for HTTPS)
After the update, both listeners for HTTP and HTTPS are forwarded to the same target group for HTTP. It seems like this part was the key.

[Node.js code]

Removed the listeners for https (443) as it was not needed and just keep the one for http (80) only.

[iptables]

Stop running iptables for 8443 as it was not needed and just keep the one for 8000 only.

This thread about running Node.js with port 80 was also helpful. ([https://stackoverflow.com/questions/16573668/best-practices-when-running-node-js-with-port-80-ubuntu-linode][1]).

Upvotes: 3

Related Questions