I have got nginx working as a reverse proxy to a number of apache servers. Each apache server is sitting in it's own virtual container, to separate things from each other (hence, the nginx reverse proxy is not doing load balancing, it's just forwarding requests to proper containers: site A goes to, site B goes to, etc).

What's the best way to handle SSL here? From what I can google, the typical way seems to be to decrypt the SSL traffic at the reverse proxy and then forward traffic as normal HTTP to the servers behind the proxy. I'm not too keen on this, as that would mean installing certificates on the proxy instead of on the servers behind it - and I'd like to keep the certificates with the containers they relate to if possible. However, HTTPS traffic is obviously encrypted, so is it even a possibility to proxy it? I'm guessing no, as I haven't come across a lot of "How to's" for it, but figured I'd ask the hive mind.

Any pointers will be much appreciated :)


Proxy'ing a HTTPS request would be a MITM attack, that's why we don't do it :)

The best practice is having the SSL terminated at the proxy and the traffic between proxy and backend to happen over unencrypted HTTP (or at least with a different set of certificates/SSL tunnel).

Just make sure to have good security on the proxies to keep the certificates safe and on the backend-proxy connection too (maybe put the proxies on a DMZ and the backends inside the firewalls).

  • Thanks for confirming my suspicions - I figured that was the reason it couldn't be done, just wasn't sure. – Fake51 Mar 22 '11 at 22:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.