Debian don't return 200 ok on HTTPS

Question

I have a problem I am running health check for my load balancer the health check uses the HTTP, HTTPS, or HTTP/2 protocol, each requires an HTTP 200 (OK) response code

I ran the below command https://my_ip:443 and it seems that there is no server as such replying with that, so it seems that it is being missing some configuration that I cannot point on

this is the response I got from running sudo netstat -plnt

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      775/sshd            
tcp6       0      0 :::80                   :::*                    LISTEN      761/apache2         
tcp6       0      0 :::22                   :::*                    LISTEN      775/sshd            
tcp6       0      0 :::443                  :::*                    LISTEN      761/apache2     

this is the response I got from running sudo ss -plnt

State      Recv-Q Send-Q                                                                              Local Address:Port                                                                                             Peer Address:Port              
LISTEN     0      128                                                                                             *:22                                                                                                          *:*                   
users:(("sshd",pid=775,fd=3))
LISTEN     0      128                                                                                            :::80                                                                                                         :::*                   
users:(("apache2",pid=832,fd=4),("apache2",pid=831,fd=4),("apache2",pid=830,fd=4),("apache2",pid=829,fd=4),("apache2",pid=828,fd=4),("apache2",pid=827,fd=4),("apache2",pid=761,fd=4))
LISTEN     0      128                                                                                            :::22                                                                                                         :::*                   
users:(("sshd",pid=775,fd=4))
LISTEN     0      128                                                                                            :::443                                                                                                        :::*                   
users:(("apache2",pid=832,fd=6),("apache2",pid=831,fd=6),("apache2",pid=830,fd=6),("apache2",pid=829,fd=6),("apache2",pid=828,fd=6),("apache2",pid=827,fd=6),("apache2",pid=761,fd=6))

Answer 1

To get this working, network tags as well as corresponding HTTP and Health Check firewall rules should be configured.

=> GCP Console => Navigation => Networking => VPC network => Firewall rules. Notice the existing rules. Perhaps necessary rules are missing.

1. Provide network tags for the backend servers. Usually those are set when a template VM image is created. Although existing instances can also be modified accordingly.

=> GCP Console => Navigation => Compute Engine => VM instances
=> Create (or Edit) 
  ... 
  Management, security, disks, networking, sole tenancy => 
    Networking => 
      Network tags = http-server 

2. Create a rule to allow HTTP traffic to the backends.

=> GCP Console => Navigation => Networking => VPC network => Firewall rules 
=> Create Firewall Rule 
  Name =                default-allow-http
  Network =             default
  Targets =             Specified target tags
  Target tags =         http-server
  Source filter =       IP Ranges
  Source IP ranges =    0.0.0.0/0   # from all networks
  Protocols and ports = Specified protocols and ports
    tcp = On, port 80
=> Create 

3. Create the Health check rule. Health checks determine which instances of a balancer can receive new connections. For HTTP load balancing, the health check probes to LB instances come from ranges 130.211.0.0/22 and 35.191.0.0/16.

=> GCP Console => Navigation => Networking => VPC network => Firewall rules 
=> Create Firewall Rule 
  Name =                default-allow-health-check
  Network =             default
  Targets =             Specified target tags
  Target tags =         http-server
  Source filter =       IP Ranges
  Source IP ranges =    130.211.0.0/22 35.191.0.0/16 
  Protocols and ports = Specified protocols and ports
    tcp = On, port all      # all TCP ports, port=all is optional
=> Create 

=> GCP Console => Navigation => Networking => VPC network => Firewall rules. Notice the freshly created rules.