A 502 Bad Gateway response means a gateway or reverse proxy received an invalid or unusable response from the upstream service. Diagnose the path between proxy and application before changing client settings.
Step-by-step checks
Confirm which component generated the 502: CDN, load balancer, reverse proxy or application gateway.
Test the upstream service directly from the proxy host and compare status, TLS negotiation and response time.
Review proxy and application logs for connection refusal, timeout, reset, TLS or malformed-header errors.
Check DNS resolution, upstream port, health checks and resource saturation before restarting services.
Useful verification commands
Run only the commands that match the platform you are troubleshooting and capture the output before making a configuration change.
curl -I https://example.invalid/
curl -vk https://upstream.example.invalid/health
How to validate the fix
The incident is closed only when the gateway can reach the intended upstream consistently, the upstream returns a valid HTTP response, and repeated client requests no longer produce 502 responses.
Evidence to keep
Keep the timestamp, gateway request ID if available, upstream status, latency and matching proxy/application log lines. These establish whether the failure was transport, TLS, timeout or application-side.