AWS Elastic Beanstalk配置负载均衡器启用SSL/HTTPS时出现HTTP 502错误

一、先搞定Tomcat 8443端口未监听的核心问题 #

Elastic Beanstalk的Tomcat环境不会用你手动改的server.xml——Beanstalk会通过平台配置文件生成自己的配置，手动改实例里的文件会在环境重启/更新时被覆盖。要让Tomcat启用8443，必须用Beanstalk的配置文件定义：

1. 在应用代码根目录创建.ebextensions文件夹
2. 新建01-tomcat-ssl.config文件，内容如下（Tomcat9版本示例，其他版本改对应路径）：

files:
  "/etc/tomcat9/server.xml":
    mode: "000644"
    owner: root
    group: root
    content: |
      <?xml version='1.0' encoding='utf-8'?>
      <Server port="8005" shutdown="SHUTDOWN">
        <Listener className="org.apache.catalina.startup.VersionLoggerListener"/>
        <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on"/>
        <Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener"/>
        <Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener"/>
        <Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener"/>

        <GlobalNamingResources>
          <Resource name="UserDatabase" auth="Container"
                    type="org.apache.catalina.UserDatabase"
                    description="User database that can be updated and saved"
                    factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
                    pathname="conf/tomcat-users.xml"/>
        </GlobalNamingResources>

        <Service name="Catalina">
          <!-- 保留8080供ELB代理转发 -->
          <Connector port="8080" protocol="HTTP/1.1"
                     connectionTimeout="20000"
                     redirectPort="8443"/>
          <!-- 启用8443端口 -->
          <Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
                     maxThreads="150" SSLEnabled="true">
            <SSLHostConfig>
              <Certificate certificateKeystoreFile="/var/lib/tomcat9/conf/localhost-rsa.jks"
                           type="RSA"/>
            </SSLHostConfig>
          </Connector>

          <Engine name="Catalina" defaultHost="localhost">
            <Realm className="org.apache.catalina.realm.LockOutRealm">
              <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
                     resourceName="UserDatabase"/>
            </Realm>

            <Host name="localhost"  appBase="webapps"
                  unpackWARs="true" autoDeploy="true">
              <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
                     prefix="localhost_access_log" suffix=".txt"
                     pattern="%h %l %u %t &quot;%r&quot; %s %b"/>
            </Host>
          </Engine>
        </Service>
      </Server>

3. 重新部署应用到Beanstalk，Tomcat启动后就会监听8443端口了。

二、配置负载均衡与HTTPS重定向 #

502错误大多是代理/ELB转发到了未监听端口，或者重定向规则错了：

1. 负载均衡器配置 #

在Beanstalk控制台配置 > 负载均衡器里设置：

• 监听443 (HTTPS)，转发到实例端口8080 (HTTP)（ELB已经处理SSL，实例内用HTTP接收更简单，不用管证书）
• 保留80 (HTTP)监听，设置重定向到443
• 确保SSL证书已关联到ELB的443监听（用AWS证书管理器的免费证书就行）

2. 代理服务器配置 #

若用Nginx：

新建.ebextensions/02-nginx-redirect.config：

files:
  "/etc/nginx/conf.d/ssl-redirect.conf":
    mode: "000644"
    owner: root
    group: root
    content: |
      server {
          listen 80;
          return 301 https://$host$request_uri;
      }

若用Apache HTTPD：

新建.ebextensions/02-apache-redirect.config：

files:
  "/etc/httpd/conf.d/ssl-redirect.conf":
    mode: "000644"
    owner: root
    group: root
    content: |
      RewriteEngine On
      RewriteCond %{HTTP:X-Forwarded-Proto} !https
      RewriteRule ^.*$ https://%{SERVER_NAME}%{REQUEST_URI} [R,L]

三、验证排查步骤 #

1. 登录EC2实例，用netstat -tulpn | grep java确认Tomcat监听8080和8443
2. 看Catalina日志/var/log/tomcat9/catalina.out，确认无启动错误
3. 检查ELB健康检查：端口设为8080，路径用你的应用健康端点（比如/health），健康检查失败会直接导致502
4. 不用重建环境——Beanstalk配置文件是持久化的，正确部署就能覆盖默认设置

四、避坑提醒 #

• 别手动改EC2实例里的Tomcat配置：Beanstalk会在更新时覆盖，必须用.ebextensions
• 没必要让Tomcat处理SSL：ELB做SSL卸载更省心，还避免证书在实例上的管理风险
• 502优先查端口监听和转发规则是否匹配，再查健康检查状态

内容的提问来源于stack exchange，提问作者Nathan