Why Are the HTTPS Replies Being Rejected?

Clients cannot load an HTTPS site on an EC2 instance. VPC Flow Logs for its network interface show two records: 198.51.100.7 to 10.0.1.25, source port 51234, destination port 443, TCP, ACCEPT; then 10.0.1.25 to 198.51.100.7, source port 443, destination port 51234, TCP, REJECT. The security group allows inbound 443 from anywhere.