<p>I've done this a dozen times before but this time, I cannot seem to connect to my web server using HTTPS. I created an <code>AWS EKS</code> cluster using <code>eksctl</code>. I deployed my deployments and services using <code>kubectl</code>. I have service URLs which are resolving on port <code>80</code>.</p>
<p>I take the service URL's, put them in <code>CNAME</code> records, and Cloudflare resolves via <code>http</code> but not <code>https</code>. I get <code>521</code> errors, when I accept connections on port <code>443</code> in my <code>Kubernetes</code> services, I get <code>SSL handshake</code> errors.</p>
<p>The thing that confuses me is I thought Cloudflare provided an <code>SSL</code> layer but using my service URLs on port <code>80</code>. It seems though that it's redirecting requests from <code>cloudflare:443</code> to <code>my-eks-cluster:443</code>.</p>
<p>How do I debug this further to get some insight into what is going on ?</p>

<p>Since your cluster works and accepts traffic, then the most probable reason is that <code>Encription mode</code> is enabled in yours Cloudflare config.</p>
<p>And, according to your post, you are going to disable <code>https</code> at all on the origin side:</p>
<blockquote>
<p>The thing that confuses me is I thought Cloudflare provided an SSL layer but using my service URLs on port 80. It seems though that it's redirecting requests from cloudflare:443 to my-eks-cluster:443.</p>
</blockquote>
<p>So, you may want to check SSL settings to be sure that current <code>Encription mode</code> is <code>Off</code></p>
<p>As per Cloudlare documentation:
<a href="https://developers.cloudflare.com/ssl/origin-configuration/ssl-modes" rel="nofollow noreferrer">Encryption modes · Cloudflare SSL docs</a></p>
<blockquote>
<p>Mode <code>Off</code>
Setting your encryption mode to <strong>Off (not recommended)</strong> redirects any HTTPS request to plaintext HTTP.</p>
</blockquote>
