nginx proxy_pass works on http but fails on https

Question

When I pass http:localhost:9000 to proxy_pass then it is working. But When I pass https:localhost:9000 then it fails

pid /var/run/nginx.pid;
worker_processes  2;

events {
    worker_connections   65536;
    use epoll;
    multi_accept on;
}

http {
    limit_req_zone $binary_remote_addr zone=basic_limit:10m rate=20r/s;
    limit_conn_zone $binary_remote_addr zone=limit_conn:1m;
    keepalive_timeout 65;
    keepalive_requests 100000;
    sendfile         on;
    tcp_nopush       on;
    tcp_nodelay      on;

    client_body_buffer_size    128k;
    client_max_body_size       10m;
    client_header_buffer_size    1k;
    large_client_header_buffers  4 4k;
    output_buffers   1 32k;
    postpone_output  1460;

    client_header_timeout  3m;
    client_body_timeout    3m;
    send_timeout           3m;

    open_file_cache max=1000 inactive=20s;
    open_file_cache_valid 30s;
    open_file_cache_min_uses 5;
    open_file_cache_errors off;

    gzip on;
    gzip_min_length  1000;
    gzip_buffers     4 4k;
    gzip_types       application/x-javascript text/css application/javascript text/javascript text/plain text/xml application/json application/vnd.ms-fontobject application/x-font-opentype application/x-font-truetype application/x-font-ttf application/xml font/eot font/opentype font/otf image/svg+xml image/vnd.microsoft.icon;
    gzip_disable "MSIE [1-6]\.";

    # [ debug | info | notice | warn | error | crit | alert | emerg ] 
    error_log  /var/log/nginx.error_log  debug;

    log_format main      '$remote_addr - $remote_user [$time_local]  '
      '"$request" $status $bytes_sent '
      '"$http_referer" "$http_user_agent" '
        '"$gzip_ratio"';

    log_format download  '$remote_addr - $remote_user [$time_local]  '
      '"$request" $status $bytes_sent '
      '"$http_referer" "$http_user_agent" '
        '"$http_range" "$sent_http_content_range"';

    map $status $loggable {
    ~^[23]  0;
    default 1;
    } 

    server {
    listen   8080;
    server_name   _;
        #ssl_certificate /etc/nginx/ssl/nginx.crt;
    #ssl_certificate_key /etc/nginx/ssl/nginx.key;
    access_log   /var/log/nginx/access.log;
    error_log    /var/log/nginx/error.log;

      location / {
        limit_req zone=basic_limit burst=30 nodelay;
        limit_conn limit_conn 20;
        limit_req_status 429;
        proxy_pass         http://127.0.0.1:9000;
        proxy_redirect     off;
        proxy_set_header   Host             $host;
        proxy_set_header Host $http_host;
        proxy_set_header X-Forwarded-Host $http_host;
        proxy_set_header   X-Real-IP        $remote_addr;
        proxy_set_header  X-Forwarded-For  $proxy_add_x_forwarded_for;
        proxy_connect_timeout      90;
        proxy_send_timeout         90;
        proxy_read_timeout         90;
        proxy_buffer_size          4k;
        proxy_buffers              4 32k;
        proxy_busy_buffers_size    64k;
        proxy_temp_file_write_size 64k;
        proxy_temp_path            /etc/nginx/proxy_temp;
    }
       location /nginx_status {
        stub_status on;
        allow 127.0.0.1;
        deny all;
    }
    }
}

Answer 1

proxy_pass http://localhost:9000 works and proxy_pass https://localhost:9000 fails

That is expected.

Under normal conditions you simply can't run both the HTTP and HTTPS service on the same port.

You first need to change the service listening to port 9000 to be HTTPS rather than HTTP before proxy_pass https://localhost:9000 will work, or make the HTTPS version of the service available on a different port and then connect to that new port using HTTPS.

But that doesn't need to happen anyway. There is no security benefit at all (and even a performance penalty) to secure localhost services with TLS. Simply terminate the TLS connection on the nginx web server and from there on continue to make a plain HTTP connection to localhost port 9000.