A network ACL applies ordered rules at a subnet boundary. The first matching rule decides the traffic, so an Allow placed after a matching Deny doesn't rescue the connection. Security groups operate separately. An open security-group rule can't override an ACL decision.
ACLs are stateless. For an incoming HTTPS connection, the response uses the client port as its destination. This lab traces a test client using ephemeral port 49152. Permit the required return range rather than assuming that an inbound port 443 rule covers both directions. The association matters as much as the entries: editing an unassociated ACL leaves the running path unchanged. You will repair rule order, restore response traffic, attach a prepared ACL, and narrow a source range, then verify the path.