A private EC2 instance cannot reach the internet through its NAT gateway

A new app instance APP1 (10.10.10.25) in the private subnet private-a (10.10.10.0/24, us-east-1a) cannot download packages. curl -m 5 https://checkip.amazonaws.com times out. A NAT gateway was created yesterday and the private route table sends 0.0.0.0/0 to it. A web server in the public subnet public-a (10.10.0.0/24) reaches the internet fine. VPC is vpc-0a1b2c3d4e5f60718, 10.10.0.0/16.