Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have got nginx working as a reverse proxy to a number of apache servers. Each apache server is sitting in it's own virtual container, to separate things from each other (hence, the nginx reverse proxy is not doing load balancing, it's just forwarding requests to proper containers: site A goes to 192.168.2.1, site B goes to 192.168.2.2, etc).

What's the best way to handle SSL here? From what I can google, the typical way seems to be to decrypt the SSL traffic at the reverse proxy and then forward traffic as normal HTTP to the servers behind the proxy. I'm not too keen on this, as that would mean installing certificates on the proxy instead of on the servers behind it - and I'd like to keep the certificates with the containers they relate to if possible. However, HTTPS traffic is obviously encrypted, so is it even a possibility to proxy it? I'm guessing no, as I haven't come across a lot of "How to's" for it, but figured I'd ask the hive mind.

Any pointers will be much appreciated :)

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

Proxy'ing a HTTPS request would be a MITM attack, that's why we don't do it :)

The best practice is having the SSL terminated at the proxy and the traffic between proxy and backend to happen over unencrypted HTTP (or at least with a different set of certificates/SSL tunnel).

Just make sure to have good security on the proxies to keep the certificates safe and on the backend-proxy connection too (maybe put the proxies on a DMZ and the backends inside the firewalls).

share|improve this answer
    
Thanks for confirming my suspicions - I figured that was the reason it couldn't be done, just wasn't sure. –  Fake51 Mar 22 '11 at 22:04
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.