3

I have some django and ruby apps, and I have a master machine acts as reverse proxy redirects to slave machines which holds those apps. Have middlewares setup on those apps so they are capable of serving https. Each machine runs its own ngnix.

Do I also configure https on those individual ngnix or do I just make changes on the master proxy machine? Thanks.

1
  • You can do it either way.
    – womble
    Jul 9, 2012 at 13:38

2 Answers 2

1

Yes, you can use nginx to reverse-proxy to application servers on the back-end (or middle-end, as it were).

You may have either your gateway or the nginx reverse-proxies handle ssl. Personally, unless everything was to be running under ssl, I would serve ssl at the nginx level.

That is not to say that you shouldn't perform load- and performance-testing to see what works best in your particular environment; You absolutely should try different configs to see what works best for you!

0

If you trust the network between your nginx proxy and your back-end machines, then you can just do client->https->nginx->http->backend.

But if you don't trust that network for any reason at all (say it is in a public cloud for instance), you can configure nginx to use https when talking to the back-end servers as well.

This obviously has a performance impact, so I would make sure to be using both client and upstream keepalives as well as SSL session caching on nginx to minimize the number of SSL handshakes involved. The symmetric crypto portion of the SSL (RC4 or AES) will likely not be a bottleneck; it's the SSL handshakes which involve public-key crypto that can become a a performance issue on high-traffic sites.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .