Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have some django and ruby apps, and I have a master machine acts as reverse proxy redirects to slave machines which holds those apps. Have middlewares setup on those apps so they are capable of serving https. Each machine runs its own ngnix.

Do I also configure https on those individual ngnix or do I just make changes on the master proxy machine? Thanks.

share|improve this question
    
You can do it either way. –  womble Jul 9 '12 at 13:38
add comment

2 Answers 2

Yes, you can use nginx to reverse-proxy to application servers on the back-end (or middle-end, as it were).

You may have either your gateway or the nginx reverse-proxies handle ssl. Personally, unless everything was to be running under ssl, I would serve ssl at the nginx level.

That is not to say that you shouldn't perform load- and performance-testing to see what works best in your particular environment; You absolutely should try different configs to see what works best for you!

share|improve this answer
add comment

If you trust the network between your nginx proxy and your back-end machines, then you can just do client->https->nginx->http->backend.

But if you don't trust that network for any reason at all (say it is in a public cloud for instance), you can configure nginx to use https when talking to the back-end servers as well.

This obviously has a performance impact, so I would make sure to be using both client and upstream keepalives as well as SSL session caching on nginx to minimize the number of SSL handshakes involved. The symmetric crypto portion of the SSL (RC4 or AES) will likely not be a bottleneck; it's the SSL handshakes which involve public-key crypto that can become a a performance issue on high-traffic sites.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.