Using GlassFish behind Nginx with SSL

Question

We have a prototype setup where Nginx acts as a load balancer SSL terminator. Behind Nginx is GlassFish 3 running our REST Web Services over HTTP (without SSL) along with other application servers.

All requests for https://api.example.com are redirected to GlassFish.

Right now this is running on the same server, so we do not have to many security concerns (GlassFish's application ports are blocked for remote access).

However, we will need to scale this soon and the load balancer (Nginx or anything else) will need to be moved to another server.

I do no have to many experience setting up SSL certificates, so I was wondering what will be our options:

1. Should we install SSL certificates for GlassFish Server (maybe self signed certificates) to ensure SSL/TLS connection after passing the load balancer?
2. Nginx has a *.example.com SSL certificate. Could we use the same SSL certificate with two different Web Servers, so Glassfish could directly receive HTTPS requests for a subdomain (https://api.example.com) without passing through Nginx or whatever loadbalancer.

I would really appreciate your help.

Answer 1

Should we install SSL certificates for GlassFish Server (maybe self signed certificates) to ensure SSL/TLS connection after passing the load balancer?

If you have wildcard SSL certificate for *.example.com, then you can avoid self-signed certificate. You can give the glassfish hostname as subdomain of example.com (for example glassfish.example.com). Then you can use proxy_ssl_verify to prevent MITM attack and ensure secure connection between load balancer and glassfish.

If you must use self-signed certificate, adding that certificate to trusted list and enabling proxy_ssl_verify should do the job.

Nginx has a *.example.com SSL certificate. Could we use the same SSL certificate with two different Web Servers, so Glassfish could directly receive HTTPS requests for a subdomain (https://api.example.com) without passing through Nginx or whatever loadbalancer.

If you mean a wildcard SSL certificate, then YES, you can install the same certificate.