Reverse proxying HTTPS from nginx to Apache

Question

I have got nginx working as a reverse proxy to a number of apache servers. Each apache server is sitting in it's own virtual container, to separate things from each other (hence, the nginx reverse proxy is not doing load balancing, it's just forwarding requests to proper containers: site A goes to 192.168.2.1, site B goes to 192.168.2.2, etc).

What's the best way to handle SSL here? From what I can google, the typical way seems to be to decrypt the SSL traffic at the reverse proxy and then forward traffic as normal HTTP to the servers behind the proxy. I'm not too keen on this, as that would mean installing certificates on the proxy instead of on the servers behind it - and I'd like to keep the certificates with the containers they relate to if possible. However, HTTPS traffic is obviously encrypted, so is it even a possibility to proxy it? I'm guessing no, as I haven't come across a lot of "How to's" for it, but figured I'd ask the hive mind.

Any pointers will be much appreciated :)

Answer 1

Proxy'ing a HTTPS request would be a MITM attack, that's why we don't do it :)

The best practice is having the SSL terminated at the proxy and the traffic between proxy and backend to happen over unencrypted HTTP (or at least with a different set of certificates/SSL tunnel).

Just make sure to have good security on the proxies to keep the certificates safe and on the backend-proxy connection too (maybe put the proxies on a DMZ and the backends inside the firewalls).