# Fwd: reverse proxy **URL:** \ **Category:** NGINX\ **Created:** [December 11, 2012, 9:59am UTC](https://www.ruby-forum.com/t/fwd-reverse-proxy/225074 "2012-12-11T09:59:07Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![aris](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/258eb7/32.png) [@aris](https://www.ruby-forum.com/u/aris)\ **Post date:** [December 11, 2012, 9:59am UTC](https://www.ruby-forum.com/t/fwd-reverse-proxy/225074/1 "2012-12-11T09:59:07Z")
Hi all, I configured an nginx server as a reverse proxy few months ago. i have apache server as a back end of the reverse proxy. Every thing worked well until i start to use ssl. When i try to redirect [https://mydomain.com](https://mydomain.com) to [https://www.mydomain.com](https://www.mydomain.com) it gives me ssl untrusted error. When i check HTTP\_X\_URL\_SCHEME on backend server it shows only http. Backend cannot understand if it is a http or https header. How do i fix this? below is my nginx vhost and back end apache vhost server { listen 443; server\_name [mydomain.com](http://mydomain.com) [www.mydomain.com](http://www.mydomain.com); ``` access_log /var/log/nginx/mydomain.com.access.log; ssl on; ssl_certificate /home/ssl/mydomain.com.crt; ssl_certificate_key /home/ssl/mydomain.com.pvk; ssl_prefer_server_ciphers on; ssl_protocols SSLv3 TLSv1; ssl_session_cache shared:SSL:2m; ssl_ciphers ``` DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:EDH-RSA-DES-CBC3-SHA:AES256-SHA:DES-CBC3-SHA:AES128-SHA:RC4-SHA:RC4-MD5; ``` charset utf-8; keepalive_timeout 70; location / { proxy_pass http://xx.xx.xx.xx:xx; proxy_redirect off; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For ``` $proxy\_add\_x\_forwarded\_for; proxy\_set\_header X-Url-Scheme $scheme; client\_max\_body\_size 10m; client\_body\_buffer\_size 128k; ``` proxy_connect_timeout 90; proxy_send_timeout 90; proxy_read_timeout 90; proxy_buffer_size 4k; ``` } ########################################################## DocumentRoot /path/ \ Options -Indexes FollowSymLinks MultiViews AllowOverride None RewriteEngine on AddDefaultCharset utf-8 RewriteCond %{HTTP\_HOST} ^[mydomain.com](http://mydomain.com) RewriteCond %{HTTPS} !=on RewriteRule ^(.\*)$ [https://www.mydomain.com$1](https://www.mydomain.com$1) [R=302,L] ``` RewriteCond %{HTTP_HOST} ^mydomain.com RewriteRule ^(.*)$ http://www.mydomain.com$1 [R=302,L] RewriteCond %{REQUEST_METHOD} !^(GET|POST|HEAD)$ RewriteRule .* - [F] RewriteRule ^(.*)$ index.php?route=$1 [L,QSA] Order allow,deny Allow from all RPAFenable On RPAFsethostname On RPAFproxy_ips xx.xx.xx.xx ``` ---
**Author:** ![Dinoosh\_Nikapitiya](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/e19adc/32.png) [@Dinoosh\_Nikapitiya](https://www.ruby-forum.com/u/Dinoosh_Nikapitiya)\ **Post date:** [December 11, 2012, 10:20am UTC](https://www.ruby-forum.com/t/fwd-reverse-proxy/225074/2 "2012-12-11T10:20:09Z")
On Tue, Dec 11, 2012 at 3:58 PM, Dinoosh Nikapitiya [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > Hi all, > > I configured an nginx server as a reverse proxy few months ago. i have > apache server as a back end of the reverse proxy. Every thing worked well > until i start to use ssl. > > When i try to redirect [https://mydomain.com](https://mydomain.com) to [https://www.mydomain.com](https://www.mydomain.com) it > gives me ssl untrusted error. SSL is handled by nginx and not usually passed at all to backend. The error probably caused by nginx serving certificate for [mydomain.com](http://mydomain.com) but the browser is accessing [www.mydomain.com](http://www.mydomain.com). Domain mismatch raises the error. Put a certificate for [www.mydomain.com](http://www.mydomain.com) instead which usually already includes [mydomain.com](http://mydomain.com) (depends on the provider) or create separate server block which has certificate for each domain (which probably better since it will skip backend entirely for the redirect). > When i check HTTP\_X\_URL\_SCHEME on backend server it shows only http. > Backend cannot understand if it is a http or https header. How did you check it? Have you tried hardcoding https to the proxy set header? ---
**Author:** ![Dinoosh\_Nikapitiya](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/e19adc/32.png) [@Dinoosh\_Nikapitiya](https://www.ruby-forum.com/u/Dinoosh_Nikapitiya)\ **Post date:** [December 11, 2012, 10:47am UTC](https://www.ruby-forum.com/t/fwd-reverse-proxy/225074/3 "2012-12-11T10:47:36Z")
Hay Edho A., We already have the certificate for both [www.mydomain.com](http://www.mydomain.com) and [mydomain.com](http://mydomain.com). But still get the error. > > When i check HTTP\_X\_URL\_SCHEME on backend server it shows only http. > > Backend cannot understand if it is a http or https header. > How did you check it? Usually php can get those headers. I just used php scrip to get it. > Have you tried hardcoding https to the proxy set header? Yes I tried that also. But still no luck. ---
**Author:** ![Dinoosh\_Nikapitiya](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/e19adc/32.png) [@Dinoosh\_Nikapitiya](https://www.ruby-forum.com/u/Dinoosh_Nikapitiya)\ **Post date:** [December 11, 2012, 11:02am UTC](https://www.ruby-forum.com/t/fwd-reverse-proxy/225074/4 "2012-12-11T11:02:13Z")
On Tue, Dec 11, 2012 at 4:47 PM, Dinoosh Nikapitiya [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > Hay Edho A., > We already have the certificate for both [www.mydomain.com](http://www.mydomain.com) and [mydomain.com](http://mydomain.com). > But still get the error. are they both in single certificate or separate? Check the DNS Name in certificate’s Subject Alternative Name. The correct certificate should include both names ([mydomain.com](http://mydomain.com) and [www.mydomain.com](http://www.mydomain.com)) if you want to have only one server block. Otherwise you have to create two separate server block: server { listen 443 ssl; server\_name [mydomain.com](http://mydomain.com); ssl\_certificate …; ssl\_certificate\_key …; return 301 https://www.mydomain.com$request\_uri; } server { listen 443 ssl; server\_name [www.mydomain.com](http://www.mydomain.com); ssl\_certificate …; … } > > > When i check HTTP\_X\_URL\_SCHEME on backend server it shows only http. > > > Backend cannot understand if it is a http or https header. > > > How did you check it? > > Usually php can get those headers. I just used php scrip to get it. My guess is apache overwritten the variable.