A 502 right after deploy is usually the proxy losing the upstream, not the TLS listener. In the error log, separate connect failed from upstream timed out and from no live upstreams. If the app port or socket moved, the proxy target still points at the old address and a config test will not catch a dead process. A keepalive pool can also pin a dead worker, so restarting only the app leaves stale connections until you reload the proxy or allow failover on 502.