How can SSL/TLS certificate issues between CloudFront and a custom origin lead to a 502 error?

SSL/TLS certificate issues are a very common cause of CloudFront 502 errors when CloudFront is configured to use HTTPS with a custom origin. This happens if: 1. **Invalid/Expired Certificate:** The SSL certificate on the origin is expired, revoked, or not valid for the domain name. 2. **Self-Signed Certificate:** CloudFront does not trust self-signed certificates by default. 3. **Incomplete Certificate Chain:** The origin doesn't provide the full certificate chain, preventing CloudFront from validating it. 4. **Hostname Mismatch:** The certificate's common name or SANs do not match the origin domain name CloudFront is connecting to. 5. **Untrusted CA:** The certificate is issued by a Certificate Authority (CA) that CloudFront does not trust. CloudFront will terminate the connection with a 502 if it cannot establish a secure and validated SSL/TLS handshake.