I want to setup an nginx server that will be used as a publicly accessible front-end webserver to reverse proxy and load-balance other apache/nginx servers that are serving PHP and django apps, and are configured with private IPs, and each is running in a different virtual machine.

Is this going to have a significant performance decrease compared to having the back-end servers publicly accessible instead?

What about SSL certificates for each domain? Do I need to have them configured in the front-end server or in the back-end servers? Does it matter where they are configured?

  • This is the preferred way to centralize your inbound traffic, harden, log, monitor, etc etc. Don't forget to confirm x-forward-for headed Dec 2, 2017 at 18:10

1 Answer 1


It's a fine solution and, assuming that the front end server isn't too far away from the backend servers, doesn't affect performance significantly. You can terminate your SSL certificates in nginx but you could have also SSL certificates on the backend to encrypt the connection between end and backend depending on where your systems are hosted. The general rule is to terminate SSL as far up the chain as you can.

  • Thanks for answering. BTW, All my applications are running inside VMs in the same physical server, so no encryption is required between the front-end and back-end servers
    – Alex
    Dec 2, 2017 at 16:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.