Random 520 error... the error go away when bypassing cloudflare

[icliniq]

Hi,
We are still investigating the root cause where a random 520 Cloudflare errors keep occuring on our website.
We did not receive any 5xx error when we bypass Cloudflare.

[fritex]

@icliniq

a random 520 cloudflare errors keep occuring on our website

Hello,

I am sorry to hear you are experiencing some issue.

Regarding Cloudflare 520 error, may I suggest you to try looking into below articles to troubleshoot the issue:

• https://support.cloudflare.com/hc/en-us/articles/115003011431-Troubleshooting-Cloudflare-5XX-errors#520error

Community Tip - Fixing Error 520: Web server is returning an unknown error

Error Try the suggestions in this Community Tip to help you fix “Error 520: Web server is returning an unknown error”. Background Error 520 is essentially a catch-all response when something unexpected happens or when the origin server incorrectly interprets or does not tolerate a request due to a protocol violation or an empty response. A 520 error occurs when the connection started on the origin web server, but that the request was not completed. The most common reason why this would occur …

Before moving to Cloudflare, was your Website working over HTTPS connection?

May I ask what SSL option have you got selected under the SSL/TLS tab at Cloudflare dashboard for your domain ( Flexible, Full, Full Strict … )?

Here is a way to re-check if you correctly setup the SSL for your domain with Cloudflare:

Deprecated - Step 2: Setting up SSL with Cloudflare

This tutorial is deprecated in favour of Get started with SSL/TLS · Cloudflare SSL/TLS docs

Archive

This tutorial covers getting SSL working with Cloudflare in various different scenarios. This assumes you already have your website set up on Cloudflare with all your DNS records set to , if not - please visit <a href="https://community.cloudflare.com/t/64309">Step 1</a>. Do you want the website to use HTTPS? Yes Do you already have a valid SSL certificate installed…

In case you do not have an SSL certificate, you can use Cloudflare SSL, if so, kindly make sure you follow the instructions as follows on the below article to setup an SSL certificate using Cloudflare Origin CA Certificate:

• Origin CA certificates · Cloudflare SSL/TLS docs

Last but not least, kindly have a look here for more information regarding correct SSL settings at the SSL/TLS tab on Cloudflare dashboard:

Why you should choose Full Strict, and only Full Strict

Unencrypted & unverified connections Imagine you open Paypal and suddenly get that warning [image] Would you continue? Probably not. For decades leaders in IT security have advocated that people upgrade their sites from unencrypted HTTP to secure HTTPS. And for a reason, everything you send via an HTTP connection is sent in plain text and can be intercepted at any point between you and the server. Equally, you’d probably not proceed if you got such a warning, right? [image] That’s when th…

Furthermore, do not skip below step and kindly re-check if Cloudflare is allowed to connect to your origin host to as follows in the below article:

• https://support.cloudflare.com/hc/en-us/articles/201897700-Allowing-Cloudflare-IP-addresses

Nevertheless, Cloudflare IP addresses list can be found here:

• IP Ranges

@icliniq

pentest.icliniq.com

This is a sub-domain.
If you do not have a valid SSL certificate which covers this hostname, you might experience 520 errors, even it’s possible if you are not using Full (Strict) SSL or at least if Cloudflare is not allowed, as already mentioned from above.

If it’s related to the SSL for your sub-domain, kindly consider looking into below wo articles:

Deprecated - SSL/TLS not working on subdomain

This tutorial is deprecated in favour of Troubleshooting · Cloudflare SSL/TLS docs

Archive

Please note, this tutorial post contains links to external sites. I am not endorsing any external links. This tutorial post covers the first steps you should take if SSL is working on your main domain, but not on a subdomain. 1. Is there a DNS record for it? Check the DNS app in your Cloudflare dashboard to see if there is a DNS record there for that subdomain. 2. Check that the DNS record is working co…

Deprecated - Subdomain too deep

This tutorial is deprecated in favour of Fix VERSION_OR_CIPHER_MISMATCH · Cloudflare SSL/TLS docs

Archive

This tutorial covers a possible reason for the SSL_ERROR_NO_CYPHER_OVERLAP and ERR_SSL_VERSION_OR_CIPHER_MISMATCH errors (Firefox and Chrome respectively) when seen on a subdomain. The Cloudflare universal certificates cover example.com and *.example.com. This means that it covers any subdomain one level below the domain you signed up with. It will cover www.example.com and subdomain.exampl…

@icliniq

pentest

Next, the name of your sub-domain indicates me some gray or bad activity could happen, and I have questions about it so please answer to us:

May I ask if this sub-domain is going to be used only by you?
Furthermore, would it be used testing Web related things, or even the doing port scanning?
In case if needed for some more information:

• https://www.cloudflare.com/learning/security/glossary/what-is-penetration-testing/

@icliniq

to provide a log

Above article about 520 error could help you.
Please, check log files at your origin host/server and consider above suggestions to troubleshoot why are they appearing on your sub-domaiun website.