0

I've setup a Nginx as a HTTP load-balancer with SSL/TLS termination for apache webservers. My question is by using Nginx to terminate ssl how do I encrypt the data back to the browser/client.

Does each apache server have to be configured to do SSL or is the data sent from apache back to Nginx for encryption? I would like to limit CPU resources on the apache webservers.

Thanks for any help on this issue.

P.S.:I'm using X-Forwarded-For on my Nginx config. Does that send the browser's certificate to the apache servers?

  • X-Forwarded-For sends the client's IP address rather than the proxy's IP address. You still need to edit your Apache logging though in order to register the client's IP address. i.e. LogFormat "%{X-Forwarded-For}i ... – HTTP500 Jul 7 '14 at 17:07
2

You have two entirely separate connections. The connection from the web browser to nginx is encrypted with SSL, and so nginx has to be configured for SSL. The connection from nginx to Apache to retrieve the data for nginx to send to the browser should be a regular http connection with no SSL, so Apache doesn't need to have any SSL configuration.

  • "The connection from nginx to Apache to retrieve the data for nginx to send to the browser should be a regular http connection with no SSL" provided you are on a private VLAN. – HTTP500 Jul 7 '14 at 16:29
  • The data from nginx to apache is unencrypted. So any data from apache to nginx will be encrypted by nginx? – User Conscious Jul 7 '14 at 16:33
  • No, the data from the client/browser to nginx will be encrypted provided nginx has been configured appropriately. nginx then proxies the requests (unencrypted) to the Apache web servers. – HTTP500 Jul 7 '14 at 16:52
  • Yes but what happens to the data from apache? Does apache send it unencrypted (because it's not configured for SSL) back to the client or does apache sent the data back to nginx, nginx encrypts it and send it back to the browser? That's my question. – User Conscious Jul 7 '14 at 17:01
  • nginx decrypts the data coming from the client, send it unencrypted to Apache. Apache sends unencrypted data to nginx, which then encrypts it before transmitting it to the client. – Tero Kilkanen Jul 7 '14 at 17:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.