Error 520 on front end with reverse proxy from my server to worker

I have an API worker running that results in an error 520 on the front-end when I serve it through ay reverse proxy on my server (nginx proxy_pass).
i.e. browser → CF front-end → my server → CF worker → my server → CF front-end FAILS with 520 → browser

  • occasionally it works
  • my nginx server always reports this (innocuous) error “SSL_read() failed (SSL: error:0A000126:SSL routines::unexpected eof while reading) while reading upstream” (apparently because CF worker is closing TCP without TLS protocol completion)
  • The proxy_pass always works if I access it without the CF front-end. (browser → my server → CF worker → my server → browser)

Detail for support: Error 520 Ray ID: 72bd0436d91f29e8 • 2022-07-16 19:06:41 UTC

Any clues?