Cloudflare returns 521 instead of connection refused when Nginx has no 443 server block

The symptom

The site sits behind Cloudflare. HTTP works fine, but HTTPS keeps returning 521 Web Server Is Down. My first instinct was that the firewall was blocking 443 — but firewalld was inactive, and the cloud provider security group already allowed 443 inbound.

Investigation

Probing the port from outside:

timeout 8 bash -c "echo > /dev/tcp/1.2.3.4/443" && echo OPEN || echo TIMEOUT

Result was TIMEOUT. On the server, ss -lntp | grep 443 returned nothing at all.

This is the key point: a firewall block usually shows up as "connection refused" or a timeout — but a port with no listening process can also timeout on some networks. From the outside the two look almost identical, while the root causes are completely different.

Root cause

The Nginx config only had a server block for port 80 — there was no listen 443 ssl at all. Nginx does not listen on a port it has not been configured for. No config, no listener, closed port.

So the sentence "the firewall already allows 443" means nothing until something is actually listening on it.

The correct order

1. Configure the 443 server block and certificate first, so Nginx really listens
2. Then confirm the cloud security group allows 443 inbound
3. Finally verify access from outside

Get the order backwards and you will spend a lot of time debugging in the wrong direction.

What to remember

521 is Cloudflare saying "I cannot reach your origin". The cause can be: nothing listening on the port, an invalid certificate, a wrong origin IP, or the origin service being down. Don't blame the firewall first.