0

I've setup a Nginx as a HTTP load-balancer with SSL/TLS termination for apache webservers. My question is by using Nginx to terminate ssl how do I encrypt the data back to the browser/client.

Does each apache server have to be configured to do SSL or is the data sent from apache back to Nginx for encryption? I would like to limit CPU resources on the apache webservers.

Thanks for any help on this issue.

P.S.:I'm using X-Forwarded-For on my Nginx config. Does that send the browser's certificate to the apache servers?

1
  • X-Forwarded-For sends the client's IP address rather than the proxy's IP address. You still need to edit your Apache logging though in order to register the client's IP address. i.e. LogFormat "%{X-Forwarded-For}i ...
    – HTTP500
    Jul 7, 2014 at 17:07

1 Answer 1

2

You have two entirely separate connections. The connection from the web browser to nginx is encrypted with SSL, and so nginx has to be configured for SSL. The connection from nginx to Apache to retrieve the data for nginx to send to the browser should be a regular http connection with no SSL, so Apache doesn't need to have any SSL configuration.

5
  • "The connection from nginx to Apache to retrieve the data for nginx to send to the browser should be a regular http connection with no SSL" provided you are on a private VLAN.
    – HTTP500
    Jul 7, 2014 at 16:29
  • The data from nginx to apache is unencrypted. So any data from apache to nginx will be encrypted by nginx? Jul 7, 2014 at 16:33
  • No, the data from the client/browser to nginx will be encrypted provided nginx has been configured appropriately. nginx then proxies the requests (unencrypted) to the Apache web servers.
    – HTTP500
    Jul 7, 2014 at 16:52
  • Yes but what happens to the data from apache? Does apache send it unencrypted (because it's not configured for SSL) back to the client or does apache sent the data back to nginx, nginx encrypts it and send it back to the browser? That's my question. Jul 7, 2014 at 17:01
  • nginx decrypts the data coming from the client, send it unencrypted to Apache. Apache sends unencrypted data to nginx, which then encrypts it before transmitting it to the client. Jul 7, 2014 at 17:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .