cloudflare error 521

The 521 error code that you're encountering is a HTTP status message from Cloudflare that means the web server refused the connection. Given that you're receiving a 521 error, it's likely that your EC2 instance isn't accepting incoming connections from Cloudflare.

Ensure that your web server (Apache, Nginx, etc.) is set up to accept requests for your domain name, the same one you set in Cloudflare.

Verify your Security Group settings: Confirm that your AWS security groups permit HTTP (port 80) and HTTPS (port 443) traffic from all of Cloudflare's IP ranges. Cloudflare proxies your traffic, which means to your server it appears as if the traffic is coming from Cloudflare.

Check your VPC Network ACLs: AWS Network Access Control Lists (ACLs) can also control the flow of traffic at the subnet level. Make sure that the ACLs associated with your EC2's subnet are allowing inbound and outbound traffic on ports 80 and 443 from Cloudflare's IP ranges.

You can find a list of Cloudflare's IP ranges here: https://www.cloudflare.com/ips/

Make sure that your DNS settings in Cloudflare are set up correctly: Cloudflare should be directed towards the public IP or Elastic IP of your EC2 instance. This means that there needs to be an "A" record that references your EC2 instance's public IP address. It's crucial that this record is configured to be proxied, indicated by an orange cloud.

Ok interesting, a few questions. Did you check the VPC's Network ACL's for allowing both Inbound and Outbound traffic? How about making sure the DNS name resolves to the correct IP? Same errors when accessing the webserver over 80? 443? Do you have any Cloudflare WAF rules enabled?

How about making sure the DNS name resolves to the correct IP? And do you get the same exact error when accessing the webserver over 80 and 443?

You can access over 80 ok, but when using 443 you get a 521 Error?

Sounds like a certificate problem or web-server/application problem, rather than an AWS problem. 521 error means the web server actively refused the connection, so the request made it to the EC2 instance, proving that network path is good and EC2 is reachable.

Check your web server and certificate configuration to ensure it is properly set up to handle HTTPS requests.

You can also check your Cloudflare SSL/TLS Settings: Double-check your SSL/TLS settings in the Cloudflare dashboard. Ensure that you have the correct encryption mode selected (e.g., Full, Full (Strict), Flexible) and that the SSL/TLS configuration matches the settings on your web server.

I Allow all traffic, ports and protocols, and I don't have any Cloudflare WAF rules How do I make sure the DNS name resolves to the correct IP