The Problem: Cloudflare 521 Errors

If you’re running Nginx behind Cloudflare and seeing 521 errors, you likely have a mismatch between your Cloudflare SSL mode and what your origin server supports.

Common scenario:

• Nginx is only listening on port 80 (HTTP)
• Cloudflare SSL mode is set to “Full” or “Full (Strict)”
• Cloudflare tries to connect to your origin on port 443
• Origin doesn’t respond → 521 Error

Understanding Cloudflare SSL/TLS Modes

Cloudflare offers four SSL modes. Understanding these is crucial:

Key differences:

• Flexible: Quick fix if your origin can’t do HTTPS, but traffic between Cloudflare and your server is unencrypted — vulnerable to MITM attacks on that leg.

• Full: Encrypts both legs, but accepts any certificate (even self-signed, expired, or attacker-provided). Provides encryption but not authentication.

• Full (Strict): The gold standard. Cloudflare validates that your origin certificate is either:

  • A valid public CA certificate
  • A Cloudflare Origin Certificate

  This prevents MITM attacks where an attacker presents a fake certificate.

Architecture Overview

Our target architecture:

┌──────────────────────────────────────────────────────────────────────┐
│                          INTERNET                                    │
└──────────────────────────┬───────────────────────────────────────────┘
                           │ HTTPS (443)
                           ▼
┌──────────────────────────────────────────────────────────────────────┐
│                     CLOUDFLARE EDGE                                  │
│              (SSL Termination + CDN + WAF)                           │
└──────────────────────────┬───────────────────────────────────────────┘
                           │ HTTPS (443) - Origin Certificate
                           ▼
┌──────────────────────────────────────────────────────────────────────┐
│                    YOUR EC2 INSTANCE                                 │
│  ┌─────────────────────────────────────────────────────────────────┐ │
│  │                    DOCKER NETWORK                               │ │
│  │                                                                 │ │
│  │   ┌─────────────┐    HTTP    ┌─────────────────────────────┐    │ │
│  │   │   NGINX     │───────────▶│     APPLICATION CONTAINERS  │    │ │
│  │   │  (SSL/443)  │            │  - Frontend (Next.js:3000)  │    │ │
│  │   │  (80→443)   │            │  - Backend (FastAPI:8000)   │    │ │
│  │   └─────────────┘            │  - Cloud APIs               │    │ │
│  │         ▲                    └─────────────────────────────┘    │ │
│  │         │                                                       │ │
│  └─────────┼───────────────────────────────────────────────────────┘ │
│            │                                                         │
│     Ports 80, 443                                                    │
└──────────────────────────────────────────────────────────────────────┘

Traffic flow:

1. Browser connects to Cloudflare over HTTPS (public SSL certificate)
2. Cloudflare connects to your origin over HTTPS (Origin Certificate)
3. Nginx terminates SSL and proxies to backend containers over HTTP
4. Backend containers communicate on internal Docker network (isolated)

Prerequisites

Before starting, ensure you have:

• A domain proxied through Cloudflare (orange cloud enabled)
• Docker and Docker Compose installed on your server
• An existing Nginx configuration (we’ll modify it)
• Access to Cloudflare dashboard
• Firewall Rules: Ensure ports 80 and 443 are open in your cloud provider’s firewall (AWS Security Group, etc.)

Step 1: Generate a Cloudflare Origin Certificate

Cloudflare Origin Certificates are free, trusted only by Cloudflare, and can be valid for up to 15 years.

1. Log into Cloudflare Dashboard
2. Select your domain
3. Navigate to SSL/TLS → Origin Server
4. Click Create Certificate
5. Configure:
   • Private key type: RSA (2048)
   • Hostnames: *.yourdomain.com, yourdomain.com
   • Validity: 15 years (recommended)
6. Click Create

⚠️ IMPORTANT: Copy both the Origin Certificate (PEM) and Private Key immediately. The private key is shown only once!

Save them to files:

 1# Create SSL directory
 2mkdir -p ssl
 3
 4# Paste the certificate
 5cat > ssl/origin.pem << 'EOF'
 6-----BEGIN CERTIFICATE-----
 7YOUR_CERTIFICATE_HERE
 8-----END CERTIFICATE-----
 9EOF
10
11# Paste the private key
12cat > ssl/origin.key << 'EOF'
13-----BEGIN PRIVATE KEY-----
14YOUR_PRIVATE_KEY_HERE
15-----END PRIVATE KEY-----
16EOF
17
18# Set secure permissions
19chmod 600 ssl/origin.key
20chmod 644 ssl/origin.pem

Add to .gitignore to never commit these:

1echo "ssl/*" >> .gitignore

Step 2: Configure Nginx for HTTPS

Here’s a complete Nginx configuration with SSL, security headers, rate limiting, and reverse proxy setup.

nginx/nginx-main.conf - Main HTTP block configuration:

 1# Main nginx configuration with security settings
 2user nginx;
 3worker_processes auto;
 4error_log /var/log/nginx/error.log warn;
 5pid /var/run/nginx.pid;
 6
 7events {
 8    worker_connections 1024;
 9    use epoll;
10    multi_accept on;
11}
12
13http {
14    include /etc/nginx/mime.types;
15    default_type application/octet-stream;
16
17    # Logging format with security information
18    log_format security '$real_ip - $remote_user [$time_local] "$request" '
19                       '$status $body_bytes_sent "$http_referer" '
20                       '"$http_user_agent" "$http_x_forwarded_for" '
21                       'rt=$request_time uct="$upstream_connect_time" '
22                       'uht="$upstream_header_time" urt="$upstream_response_time"';
23
24    access_log /var/log/nginx/access.log security;
25
26    # Pro Tip: use $real_ip in log_format so you see actual visitor IPs, not Cloudflare's.
27
28    # Basic settings
29    sendfile on;
30    tcp_nopush on;
31    tcp_nodelay on;
32    keepalive_timeout 65;
33    types_hash_max_size 2048;
34    server_tokens off;  # Hide nginx version
35
36    # Gzip compression
37    gzip on;
38    gzip_vary on;
39    gzip_proxied any;
40    gzip_comp_level 6;
41    gzip_types text/plain text/css text/xml text/javascript 
42               application/json application/javascript application/xml+rss;
43
44    # Rate limiting zones
45    limit_req_zone $binary_remote_addr zone=general_limit:10m rate=50r/s;
46    limit_req_zone $binary_remote_addr zone=api_limit:10m rate=30r/s;
47    limit_req_zone $binary_remote_addr zone=burst_limit:10m rate=200r/m;
48    limit_conn_zone $binary_remote_addr zone=conn_limit:10m;
49
50    include /etc/nginx/conf.d/*.conf;
51}

nginx/nginx.conf - Server block configuration with SSL:

  1# Cloudflare IP handling - extract real client IP
  2map $http_cf_connecting_ip $real_ip {
  3    "" $remote_addr;
  4    default $http_cf_connecting_ip;
  5}
  6
  7# Cloudflare protocol handling
  8map $http_x_forwarded_proto $forwarded_proto {
  9    "" $scheme;
 10    default $http_x_forwarded_proto;
 11}
 12
 13# HTTP Server (Port 80) - Redirect to HTTPS
 14server {
 15    listen 80;
 16    server_name _;
 17
 18    # Health check (keep on port 80 for internal monitoring)
 19    location /health {
 20        access_log off;
 21        return 200 "healthy\n";
 22        add_header Content-Type text/plain;
 23    }
 24
 25    # Redirect all other traffic to HTTPS
 26    location / {
 27        return 301 https://$host$request_uri;
 28    }
 29}
 30
 31# HTTPS Server (Port 443)
 32server {
 33    listen 443 ssl http2;
 34    server_name _;
 35
 36    # SSL Configuration - Cloudflare Origin Certificate
 37    ssl_certificate /etc/nginx/ssl/origin.pem;
 38    ssl_certificate_key /etc/nginx/ssl/origin.key;
 39    
 40    # Modern SSL settings
 41    ssl_protocols TLSv1.2 TLSv1.3;
 42    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
 43    ssl_prefer_server_ciphers off;
 44    ssl_session_timeout 1d;
 45    ssl_session_cache shared:SSL:10m;
 46    ssl_session_tickets off;
 47
 48    # Connection and request limits
 49    limit_conn conn_limit 100;
 50    client_max_body_size 50M;
 51    client_body_buffer_size 4M;
 52
 53    # Timeout limits (prevent slowloris attacks)
 54    client_body_timeout 10s;
 55    client_header_timeout 10s;
 56    send_timeout 10s;
 57
 58    # Security headers
 59    add_header X-Frame-Options "SAMEORIGIN" always;
 60    add_header X-Content-Type-Options "nosniff" always;
 61    add_header X-XSS-Protection "1; mode=block" always;
 62    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
 63    add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;
 64    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self' https:; frame-src 'self';" always;
 65
 66    # Frontend - Next.js
 67    location / {
 68        limit_req zone=general_limit burst=100 nodelay;
 69        
 70        proxy_pass http://frontend:3000;
 71        proxy_http_version 1.1;
 72        proxy_set_header Upgrade $http_upgrade;
 73        proxy_set_header Connection 'upgrade';
 74        proxy_set_header Host $host;
 75        proxy_set_header X-Real-IP $real_ip;
 76        proxy_set_header X-Forwarded-For $real_ip;
 77        proxy_set_header X-Forwarded-Proto $forwarded_proto;
 78        proxy_cache_bypass $http_upgrade;
 79    }
 80
 81    # Backend API
 82    location /api {
 83        limit_req zone=api_limit burst=50 nodelay;
 84        
 85        proxy_pass http://backend:8000;
 86        proxy_http_version 1.1;
 87        proxy_set_header Host $host;
 88        proxy_set_header X-Real-IP $real_ip;
 89        proxy_set_header X-Forwarded-For $real_ip;
 90        proxy_set_header X-Forwarded-Proto $forwarded_proto;
 91        
 92        # Increased timeouts for long-running requests
 93        proxy_connect_timeout 300s;
 94        proxy_send_timeout 300s;
 95        proxy_read_timeout 300s;
 96    }
 97
 98    # Health check
 99    location /health {
100        access_log off;
101        return 200 "healthy\n";
102        add_header Content-Type text/plain;
103    }
104}

Docker DNS Caveat: Nginx caches DNS records at startup. If your backend container restarts and gets a new IP, Nginx might start returning 502 errors. To prevent this, use Docker’s internal resolver resolver 127.0.0.11 valid=30s; and variables for proxy_pass targets.

Step 3: Update Dockerfile

Update your Nginx Dockerfile to expose both ports:

nginx/Dockerfile:

 1FROM nginx:alpine
 2
 3# Copy configurations
 4COPY nginx-main.conf /etc/nginx/nginx.conf
 5COPY nginx.conf /etc/nginx/conf.d/default.conf
 6
 7# Expose HTTP and HTTPS ports
 8EXPOSE 80 443
 9
10CMD ["nginx", "-g", "daemon off;"]

Step 4: Update Docker Compose

Mount the SSL certificates and expose port 443:

docker-compose.yml (nginx service section):

 1services:
 2  nginx:
 3    build:
 4      context: ./nginx
 5      dockerfile: Dockerfile
 6    container_name: my-nginx
 7    restart: unless-stopped
 8    ports:
 9      - "80:80"
10      - "443:443"
11    depends_on:
12      - frontend
13      - backend
14    networks:
15      - app-network
16    volumes:
17      - ./ssl:/etc/nginx/ssl:ro  # Read-only mount
18    healthcheck:
19      test: ["CMD", "curl", "-f", "http://localhost/health"]
20      interval: 30s
21      timeout: 10s
22      retries: 3
23
24networks:
25  app-network:
26    driver: bridge

Step 5: Deploy

Rebuild and deploy only the nginx container (zero downtime for other services):

1# Build the new nginx image
2docker compose build nginx
3
4# Recreate nginx container without touching dependencies
5docker compose up -d --no-deps nginx
6
7# Verify nginx is running
8docker compose logs nginx --tail=20

If you have a deploy script like prod.sh, you might need:

1# If container name conflicts exist
2docker stop my-nginx && docker rm my-nginx
3./prod.sh -d nginx

Step 6: Enable Full (Strict) Mode in Cloudflare

Now that your origin supports HTTPS with a valid Origin Certificate:

1. Go to Cloudflare Dashboard → SSL/TLS → Overview
2. Change encryption mode from Flexible or Full to Full (Strict)

This change takes effect immediately.

Step 7: Verify

Test the connection:

1curl -I https://yourdomain.com

Expected output shows HTTP/2 200 with Cloudflare and security headers:

HTTP/2 200 
server: cloudflare
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
content-security-policy: default-src 'self'...
cf-ray: xxxxxxxx-XXX

Troubleshooting

521 Error (Web server is down)

• Origin not listening on port 443
• Firewall blocking port 443
• Nginx failed to start (check certificate paths)

1# Check nginx logs
2docker compose logs nginx
3
4# Verify nginx config syntax
5docker compose exec nginx nginx -t

525 Error (SSL handshake failed)

• Certificate/key mismatch
• Invalid certificate format
• Wrong file permissions

1# Verify certificate and key match
2openssl x509 -noout -modulus -in ssl/origin.pem | openssl md5
3openssl rsa -noout -modulus -in ssl/origin.key | openssl md5
4# Both should output the same MD5 hash

526 Error (Invalid SSL certificate)

• Only occurs in Full (Strict) mode
• Origin certificate not trusted by Cloudflare
• Certificate expired or for wrong hostname

1# Check certificate details
2openssl x509 -in ssl/origin.pem -text -noout | grep -A2 "Subject:"
3openssl x509 -in ssl/origin.pem -text -noout | grep -A2 "Validity"

Security Considerations

What This Setup Protects Against

Additional Hardening (Optional)

1. Authenticated Origin Pulls: Mutual TLS where Cloudflare presents a client certificate

   1ssl_client_certificate /etc/nginx/ssl/cloudflare-origin-pull.pem;
   2ssl_verify_client on;

2. Restrict Origin to Cloudflare IPs Only: Configure AWS Security Groups or iptables to only accept connections from Cloudflare IP ranges

3. Enable HSTS in Cloudflare: SSL/TLS → Edge Certificates → Always Use HTTPS + HSTS

Quick Reference

Trade-offs and Limitations

1. Vendor Lock-in: Cloudflare Origin Certificates are not trusted by major browsers, only by Cloudflare. This means you cannot bypass Cloudflare and connect directly to your origin server IP in a browser without getting severe security warnings. If you ever move away from Cloudflare, you will need to replace these certificates with standard ones (e.g., Let’s Encrypt).

2. Local Development: Since these certificates are for specific public domains, you can’t easily use them for localhost development. A common pattern is to have a separate docker-compose.override.yml for local development that overrides the Nginx config to listen on HTTP only or uses mkcert for locally trusted self-signed certificates.

Conclusion

With this setup, you now have:

✅ End-to-end encryption from browser to origin
✅ MITM protection on all network segments
✅ Zero-cost SSL with 15-year Cloudflare Origin Certificate
✅ Rate limiting and security headers
✅ Docker-based deployment for easy management

The key insight is that Full (Strict) mode is what provides actual security. Without it, Cloudflare will accept any certificate from your origin, including one presented by an attacker performing a MITM attack.

Further Reading

• Cloudflare Origin CA certificates
• Cloudflare SSL/TLS encryption modes
• Authenticated Origin Pulls
• Nginx SSL configuration best practices