Ingress Error References

Depending on whether a request routes to an AWS regional cluster or a dedicated bare-metal server, rejection signatures vary:

403 Forbidden / 496 No Cert

• AWS Regional ALBs: Returns HTTP 403 Forbidden with the response header X-Amzn-Errortype: HandshakeFailure.
• Bare-Metal Proxies (Caddy/Nginx): Returns 496 No Cert or 400 Bad Request (SSL certificate error).
• Root Cause: Missing, expired, or unrecognized client certificate.
• Resolution: Verify certificate validity with openssl x509 -enddate -noout -in <cert_file>.

502 Bad Gateway / 504 Gateway Timeout

• AWS ALB Targets: The regional load balancer verified your certificate, but all backend targets in the target group failed health checks.
• Bare-Metal Targets: The ingress proxy verified your certificate, but the underlying application process or local container daemon is offline.
• Resolution: Check service status in the Service Catalog.