I have an Ubuntu server running NGINX as a reverse proxy to kestrel and a .net core application hosted on port 5008 for http and 5009 for https.

I had this all working, but something is now wrong in configuration and am getting back ERROR 502 BAD GATEWAY from NGINX, apparently when trying get to port 443/ssl.

I have this nginx thread runinng under MyUser, the .net app folder is chowned by MyUser, but ssl cert folders are not.

I can’t for the life of me see what is wrong. Logs aren’t helping…

http {
   include        /etc/nginx/mime.types;
   include        /etc/nginx/fastcgi.conf;
   index          index.html;

   sendfile       on; 
   tcp_nopush     on;

   default_type   application/octet-stream;

   server { 
        listen          80 default_server;
        server_name     mysite.com www.mysite.com;
        
        return 301 https://$host$request_uri;   
    }

    server {
        listen      443 ssl;
        server_name localhost;
        ssl_certificate /etc/nginx/ssl/bundle.crt;
        ssl_certificate_key /etc/nginx/ssl/private.key;

         root      /var/www;
         index     index.html;

    location / {
                proxy_pass         http://127.0.0.1:5008;
                proxy_redirect     off;
                proxy_http_version 1.1;
                proxy_cache_bypass $http_upgrade;
                proxy_set_header   Upgrade $http_upgrade;
                proxy_set_header   Connection keep-alive;
                proxy_set_header   Host $host;
                proxy_set_header   X-Real-IP $remote_addr;
                proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header   X-Forwarded-Proto $scheme;
                proxy_set_header   X-Forwarded-Host $server_name;
        }
    }
}

  "Kestrel": {
    "Endpoints": {
      "Http": {
        "Url": "http://localhost:5008"
      },
      "HttpsInlineCertFile": {
        "Url": "https://localhost:5009",
        "Certificate": {
         // REMOVED
        }
      }
    },
    "Https": {
      "Url": "https://*:5009",
      "Certificate": {
         // REMOVED
      }
    },
    "Certificates": {
      "Default": {
          // REMOVED
      }
    }
  },
  "AllowedHosts": "*",

My .NET App seems happy, but there is a warning which smelled to me:

2024-05-08 10:05:36.585 +00:00 [WRN] Overriding address(es) 'http://127.0.0.1:5008, http://localhost:5008'. Binding to endpoints defined via IConfiguration and/or UseKestrel() instead.
2024-05-08 10:05:36.597 +00:00 [INF] Now listening on: http://localhost:5008
2024-05-08 10:05:36.598 +00:00 [INF] Now listening on: https://localhost:5009

however digging further in that direction didn’t prove fruitful.