Worker fetch causes 521 error over HTTPS on port 9200

[joe.peruzzi]

I am attempting to connect to an external web service that is running over a non-starndard port (9200), it uses https and can be called from any web request (wget, curl, python, Azure Functions, Powershell, and postman all were tested) so we know its operational.

However, the Cloudflare worker is the only system that can’t seem to access this api server. We tried using the IP address but quickly found out that 403 messages are given to us by Cloudflare (weird but ok) so the domain was used now we are getting 521 errors.

The api server is using a self-signed certificate (this is not production, we are just testing so lets move past the security of this it won’t go into prod) so we are not sure if its the port causing Cloudflare to throw a 521 or the certificate.

Any help on this would be very much appreciated, assume we have no control over the certificate. Here is the code block throwing the 521 error code.

let urlWithPort = new URL("https://my-aws-site:9200/api)
var headers = {"Content-Type":"application/json","Accept":"*/*","credentials":"include","Authorization":"ApiKey *****"}

const response = await fetch(urlWithPort, {
    method: "POST", 
    headers : new Headers(headers),
    body: event_list.map(JSON.stringify).join('\n') + '\n'
  });

[KianNH]

Workers can’t fetch a non-standard port and also require a publicly trusted certificate.

[albert]

@KianNH is almost right. You can send requests to non-standard ports, but the target domain must be in the same zone as the Worker. You can create a CNAME record in your zone pointing to my-aws-site.

Please consult the flowchart below to determine which port a request will be sent to.

[joe.peruzzi]

I setup a 443 port forward and now get, as expected based on the comments above, 526 errors as its a self signed cert. Oh well we’ll work on getting a valid cert in dev, thanks for the insights!