I wish to set up a new website that will be accessed by users using HTTPS. I think it is good practise to put the "real" web server in a seperate subnet, and then install an Apache Reverse Proxy in a DMZ.
My question is, where should I put the SSL cert(s)? Should I
a) Use a self-signed cert on the "real" web server, and a proper cert on the reverse proxy?
b) Use 2 real certs on both the "real" web server and the reverse proxy?
c) Don't use any cert on the "real" web server, and use a proper cert on the reverse proxy?
I'd like to use a) or c), if possible. I also don't want anyone's browser complaining of a self-signed cert.