For PCI compliance, my application is forced to use a secure/encrypted connection between the reverse proxy server and backend app server, whereas the connection coming into the reverse proxy is on port 80, i.e. the reverse proxy needs to act as a http-to-https converter.

A simple diagram:

IIS7<---port 443---nginx<----port 80----Internet

I'm evaluating using nginx over squid for this, and this is what I have in my nginx.conf so far:

worker_processes  1;
events {
    worker_connections  1024;

http {
    include       mime.types;
    default_type  application/octet-stream;

    sendfile        on;
    keepalive_timeout  65;

    upstream backend {
        server mybackendserver:443;

    server {
        server_name www.mysite.com
        listen       80;
        ssl on;
        ssl_certificate /etc/nginx/server.crt;
        ssl_certificate_key /etc/nginx/server.key;
        ssl_verify_client off;
        location = / {
                    proxy_pass  https://backend;
                proxy_set_header Host $http_host;
            proxy_set_header X_FORWARDED_PROTO https;



The above gives: "400 Bad Request The plain HTTP request was sent to HTTPS port" when I browse to www.mysite.com.

Where am I going wrong? Is this even doable? Is nginx better than squid for this purpose?

Thanks in advance, G

| improve this question | | | | |
  • "For PCI compliance..." I'll bet you don't. – womble Aug 8 '11 at 20:24

proxy_pass is able to proxy to HTTPS, this is not a problem.

You have an error in your configuration. Remove lines

ssl on;
ssl_certificate /etc/nginx/server.crt;
ssl_certificate_key /etc/nginx/server.key;
ssl_verify_client off;

These are turning on SSL server at Nginx side, which means your Nginx expects SSL connection at port 80. Since browsers send ordinary HTTP to port 80, Nginx complains "400 Bad Request The plain HTTP request was sent to HTTPS port"

| improve this answer | | | | |
  • Excellent! That is the answer I was looking for, thanks. – G Chuk Aug 9 '11 at 20:13
  • 12
    Accept it then :) – Alexander Azarov Aug 9 '11 at 20:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.