Ubuntu 20.04 mailman3 3.2.2-1 mailman3-web 0+20180916-10 python3-django 2:2.2.9-2ubuntu1

In /etc/mailman3/uwsgi.ini (example.org is defined in the local /etc/hosts as 10.0.0.1):

[uwsgi]
# Port on which uwsgi will be listening.
### suwsgi: uwsgi protocol over TLS
uwsgi-socket = example.org:8430
# https://uwsgi-docs.readthedocs.io/en/latest/HTTPS.html?highlight=ssl
https = /etc/ssl/example.org.crt,/etc/ssl/example.org_rsakey.pem.decrypted,HIGH
...
# Drop privileges and don't run as root.
uid = www-data
gid = www-data
...

I suppose that uwsgi reads the certificate & its private key before dropping root privileges. Right now, uwsgi cannot access them as www-data.

In /etc/mailman3/mailman-web.py (symlinked to django settings.py) :

...
SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_SCHEME', 'https')
# Other security settings
# SECURE_SSL_REDIRECT = True
# If you set SECURE_SSL_REDIRECT to True, make sure the SECURE_REDIRECT_EXEMPT
# contains at least this line:
# SECURE_REDIRECT_EXEMPT = [
#     "archives/api/mailman/.*",  # Request from Mailman.
#     ]
# SESSION_COOKIE_SECURE = True
# SECURE_CONTENT_TYPE_NOSNIFF = True
# SECURE_BROWSER_XSS_FILTER = True
# CSRF_COOKIE_SECURE = True
# CSRF_COOKIE_HTTPONLY = True
# X_FRAME_OPTIONS = 'DENY'
...
POSTORIUS_TEMPLATE_BASE_URL = 'https://example.org:8430'

In /etc/nginx/sites-enabled/example.org.conf

...
        location / 
        {
                include /etc/nginx/uwsgi_params;
                # upstream app server
                uwsgi_pass suwsgi://example.org:8430;
        }

uwsgi is listening on the right address/port:

# networks-list-connections.sh | grep :8430
tcp        0      0 10.0.0.1:8430      0.0.0.0:*               LISTEN      33         54336045   1768187/uwsgi       

Despite those settings and all the relevant systemd services restarted, I get 502 Bad Gateway while browsing to https://example.org/postorius/lists/?all-lists (or any other page) with the following error nginx message:

*1 peer closed connection in SSL handshake while SSL handshaking to upstream, client: 10.0.0.1, server: example.org, request: "GET /postorius/lists/?all-lists HTTP/2.0", upstream: "suwsgi://10.0.0.1:8430", host: "example.org", referrer: "https://example.org/postorius/lists/"

Of course, without those specific https/suwsgi settings, everything works fine. What am I missing/doing incorrectly? Does uwsgi need access to the certificate/private key while running as non-root for instance?