1
Diagnostic step 1
Collect ALB access logs and ELB TLS logs with timestamps for failed requests and correlate with backend logs; capture full ALB flow tracing if using AWS X-Ray or ALB request tracing.
FULL AI ANALYSIS
ALB returns 502 for gRPC over HTTP/2 after enabling TLS policy to TLS1.3-only
Generated Oct 3, 2026, 12:35:03 AM
Analysis summary
ALB acts as TLS terminator and speaks HTTP/2 to the backend. Switching to TLS1.3-only changes the ALPN and handshake characteristics between clients and ALB. Possible causes include ALB internal handling bugs for HTTP/2 over TLS1.3, ALB cipher suite mismatches causing early connection failures that show as 502, or client ALPN mismatch leading to ALB treating some streams as non-gRPC. The fact that rolling back policy resolves the issue points to ALB-side handling of TLS1.3 policy or client ALPN negotiation problems rather than backend application errors.
Possible causes
ALB internal bug or limitation handling HTTP/2/gRPC when frontend uses TLS1.3-only policy, causing misinterpretation of ALPN or streams.
85%Cipher suite selection under TLS1.3-only policy results in unexpected record framing from ALB's TLS termination path, exposing an ALB implementation edge-case.
60%Intermittent TLS handshakes failing due to buggy client-side TLS version implementations leading to half-open connections presented to ALB.
45%Client TLS stacks negotiating TLS1.3 with ALB but using ALPN values not expected by ALB for HTTP/2, resulting in ALB failing to forward correctly.
20%Suggested fixes
2
Diagnostic step 2
Use a controlled test client that supports TLS1.3 and ALPN h2 to reproduce errors; record client TLS handshake and ALPN negotiation (e.g. using openssl s_client -alpn h2 -tls1_3) against the ALB to compare successful vs failing traces.
3
Diagnostic step 3
Test a narrow change: create a separate ALB listener using TLS1.3-only policy and point a small percentage of traffic or a canary client there to replicate without impacting majority of traffic.
4
Diagnostic step 4
If reproduction is consistent, open an AWS support ticket providing ALB access logs, backend logs, and client TLS traces. AWS support can inspect internal ALB handling and known TLS1.3 issues. Until resolved, keep TLS1.2+TLS1.3 policy as the safe fallback in production.
5
Diagnostic step 5
As a temporary mitigation, consider terminating TLS at backend (end-to-end TLS) or ensure clients negotiate ALPN 'h2' explicitly; escalate to AWS if you require TLS1.3-only policy for compliance and ALB behavior blocks rollout.