Flask application is not receiving eventsub subscription request POST

[jaska]

Here’s what I’ve done so far in setting up eventsub:

• I’ve got a website set up on a public IP
• I’ve got my client ID, client secret, and oauth token
• Flask app is listening on port 443 (verified with a curl request from another server)

When I provide the URL as the webhook value in the initial request data, I don’t receive anything. However, when I change that value to another callback URL (using webhook.site for example), I do see the POST request from twitch. cURL requests from another server to my own callback url work, and I see the debug output from the flask app running in the terminal.

Works:

curl -k -X POST https://www.mysite.com/webhooks/twitch-callback -d '{"test": "yes"}' -H "Content-Type: application/json" -H 'twitch-eventsub-subscription-type: webhook_callback_verification'
curl -k -X POST http://www.mysite.com:443/webhooks/twitch-callback -d '{"test":"yes"}' -H "Content-Type: application/json" -H 'twitch-eventsub-subscription-type: webhook_callback_verification'

Works when transport[“callback”] is set to a webhook.site URL, but NOT when my own URL is specified:

 curl -X POST -H "Client-ID: {CLIENT_ID}" -H "Authorization: Bearer {TOKEN}" -H "Content-Type: application/json" -d '@request.json' https://api.twitch.tv/helix/eventsub/subscriptions

request.json:
{
    "type": "channel.follow",
    "version": "1",
    "condition": {
        "broadcaster_user_id": "{ID}"
    },
    "transport": {
        "method": "webhook",
        "callback": {webhook.site URL/my own URL},
        "secret": "{SECRET}"
    }
}

route is set up in Flask like this:

@app.route('/webhooks/twitch-callback',methods=['POST'])
def respond():
    # some debug output to see when it's been called

and run like:

sudo -E flask run --host=0.0.0.0 --cert=adhoc -p443

When I use self-signed certs instead of adhoc, I receive data from Twitch, but it’s loaded with errors:

108.80.10.239 - - [31/May/2022 16:15:34] code 400, message Bad request syntax ('\x16\x03\x01\x02\x00\x01\x00\x01ü\x03\x03\x92öÏÊ«xe[&\x81\x07Î$YÕ\x9dÑ\x05')
108.80.10.239 - - [31/May/2022 16:15:34] "üöÏÊ«xe[&Î$YÕ" HTTPStatus.BAD_REQUEST -
52.12.79.235 - - [31/May/2022 16:15:35] code 400, message Bad request version ('À\x13À')
52.12.79.235 - - [31/May/2022 16:15:35] "ýù{fn¨a
»rKn£é%&À+À/À,À0̨̩À   ÀÀ" HTTPStatus.BAD_REQUEST -
108.80.10.239 - - [31/May/2022 16:15:43] code 400, message Bad request version ('\x8b2\x93o\xadËj\x95\x00"\x13\x01\x13\x03\x13\x02À+À/̨̩À,À0À')
108.80.10.239 - - [31/May/2022 16:15:43] "üIÀ
                                                     ôwU£©>®IIëL¤rã6§aÜ>òÕ
                                                                            2o­Ëj"À+À/̨̩À,À0À" HTTPStatus.BAD_REQUEST -

Any ideas are appreciated!