A 502 on this setup is often the upstream socket rather than TLS. Compare the proxy_pass host and port with the address actually listening, then curl that upstream from the proxy host itself. If the upstream answers but the browser loops on redirects, the app is emitting absolute http locations because X-Forwarded-Proto never arrived, or a trailing slash on proxy_pass rewrote the path into a 404 that the app turns into a redirect. Run nginx -t, reload, and one curl -I of the public path shows which of the three it was.