Plesk HTTPS Not Working? Fix 502 Bad Gateway and ERR_CONNECTION_REFUSED SSL Errors

If all websites on your Plesk server suddenly stopped loading over HTTPS while HTTP still works, you are almost certainly looking at a corrupted or missing Apache SSL module configuration. This typically happens after a Plesk update, an OS package upgrade, or a plesk repair run that does not complete cleanly. This guide covers every fix for Plesk HTTPS errors including 502 Bad Gateway, ERR_CONNECTION_REFUSED, and SSL handshake failures — with exact commands for both RHEL/CentOS and Debian/Ubuntu servers.

Understanding Why Plesk HTTPS Fails on All Sites Simultaneously

When a single site stops working over HTTPS in Plesk, the cause is usually a certificate problem specific to that domain. But when all sites fail at once, the root cause is almost always at the web server level, not the certificate level.

In Plesk's dual-stack setup (nginx as reverse proxy in front of Apache), HTTPS traffic flows like this:

• Client → nginx (port 443, terminates SSL) → Apache (port 7081, internal) → PHP/content

If Apache is not listening on port 7081 with SSL enabled, nginx cannot proxy HTTPS requests to it, resulting in 502 Bad Gateway or ERR_CONNECTION_REFUSED for every domain on the server.

If nginx is disabled (Apache-only mode), Apache must listen directly on port 443. If the Apache SSL module is not loaded, all HTTPS connections fail immediately.

Step 1: Confirm the Error and Identify the Stack

Before running any fixes, confirm exactly what is failing.

Check if Apache is listening on SSL ports:

ss -tlnp | grep -E '7081|443'
# With nginx+Apache: should see 7081 (Apache) and 443 (nginx)
# Apache-only: should see 443 (Apache)

If port 7081 or 443 shows nothing for Apache, the SSL module is not loaded.

Check Apache error logs:

# CentOS/RHEL
tail -50 /var/log/httpd/error_log

# Debian/Ubuntu  
tail -50 /var/log/apache2/error.log

Look for messages like:

• Invalid command 'SSLEngine' — mod_ssl not loaded
• Cannot load modules/mod_ssl.so — SSL module binary missing
• AH00526: Syntax error on line N of /etc/httpd/conf.d/ssl.conf — corrupted ssl.conf

Check nginx error logs (if nginx is enabled):

tail -50 /var/log/nginx/error.log

Look for connect() failed (111: Connection refused) pointing to 127.0.0.1:7081 — this confirms nginx cannot reach Apache on the SSL port.

Step 2: Fix on CentOS / RHEL / AlmaLinux / Rocky Linux

The most reliable fix on RPM-based systems is to reinstall mod_ssl and then run plesk repair web.

yum reinstall mod_ssl -y

plesk repair web -y

ss -tlnp | grep 7081

curl -Ik https://yourdomain.com

apache2ctl -M | grep ssl

a2enmod ssl
systemctl restart apache2

ln -s /etc/apache2/mods-available/ssl.conf /etc/apache2/mods-enabled/ssl.conf
ln -s /etc/apache2/mods-available/ssl.load /etc/apache2/mods-enabled/ssl.load
systemctl restart apache2

plesk repair web -y

plesk repair web -domains-only yourdomain.com

openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null | openssl x509 -noout -dates -subject

Step 6: Verify the Fix Across All Domains

After the repair, run a quick bulk check to confirm all domains are responding on HTTPS:

for domain in $(plesk bin domain --list); do
  code=$(curl -sk -o /dev/null -w "%{http_code}" "https://$domain")
  echo "$code $domain"
done

Any domain returning 000 (connection refused) or 502 still needs attention — check its individual Hosting Settings and certificate assignment in Plesk.

For a comprehensive SSL quality check, run your primary domain through SSL Labs (ssllabs.com/ssltest) after the fix to confirm the certificate chain is complete, TLS 1.2+ is negotiated, and no old cipher suites are exposed.

If your Plesk server keeps losing HTTPS after updates or you need help diagnosing recurring SSL configuration issues, CloudHouse's managed server team provides emergency Plesk support with guaranteed response times.