# How to setup nginx as reverse proxy + tomcat ssl **URL:** \ **Category:** NGINX\ **Created:** [March 31, 2010, 10:10am UTC](https://www.ruby-forum.com/t/how-to-setup-nginx-as-reverse-proxy-tomcat-ssl/186084 "2010-03-31T10:10:20Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![kaiyuan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/47e85d/32.png) [@kaiyuan](https://www.ruby-forum.com/u/kaiyuan)\ **Post date:** [March 31, 2010, 10:10am UTC](https://www.ruby-forum.com/t/how-to-setup-nginx-as-reverse-proxy-tomcat-ssl/186084/1 "2010-03-31T10:10:20Z")
Hey guys, I am totally new to Nginx, I need some advice with my reverse proxy setup. This is what i am trying to set up. Client(commit a client cert)\<========\>| Nginx (reverse proxy with ssl)|\<========\>Tomcat (with SSL and clientAuth=true) Follow is my nginx.conf,but it don’t work.The messge from nginx logs: 2010/04/01 15:18:53 23771#0: \*51 SSL\_do\_handshake() failed (SSL: error:14094412:SSL routines:SSL3\_READ\_BYTES:sslv3 alert bad certificate) while SSL handshaking to upstream, client: 192.168.2.225, server: localhost, request: “GET /prepayms/ HTTP/1.1”, upstream: “[https://192.168.2.33:18444/prepayms/](https://192.168.2.33:18444/prepayms/)”, host: “192.168.2.48:48443” nginx.conf: upstream backssl{ server 192.168.2.33:18444; ``` }# HTTPS server server { listen 48443 default ssl; server_name localhost; ssl on; ssl_client_certificate /home/newprepay/ca/ca-cert.pem; ssl_certificate /home/newprepay/server/server-cert.pem; ssl_certificate_key /home/newprepay/server/server.key; ssl_session_timeout 5m; ssl_verify_client on; ``` ssl\_verify\_depth 12; ssl\_session\_cache builtin:1000 shared:SSL:10m; ``` ssl_protocols TLSv1 SSLv2 SSLv3; ssl_ciphers ``` ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+SSlv3:+EXP; ssl\_prefer\_server\_ciphers on; ``` location / { root html; index index.html index.htm; proxy_redirect off; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $http_host; ``` proxy\_pass [https://backssl](https://backssl); My questions are Can I have an SSL from Client to Nginx and another between Nginx and Tomcat ，nginx verify the client certificate,and also transfer the client certificate to tomcat,tomcat also verify the client certificate. if nginx can do this,how to setup.Can someboby give me an correct nginx.conf for this? Thank You, kaiyuan Posted at Nginx Forum: > **[how to setup nginx as reverse proxy + tomcat ssl](https://forum.nginx.org/read.php?2,69690,69690#msg-69690)** > > Hey guys, I am totally new to Nginx, I need some advice with my reverse proxy setup. This is what i am trying to set up. Client(commit a client cert)\<========\>| Nginx (reverse proxy with ssl)|\<========\>Tomcat (with SSL and... ---
**Author:** ![kaiyuan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/47e85d/32.png) [@kaiyuan](https://www.ruby-forum.com/u/kaiyuan)\ **Post date:** [March 31, 2010, 10:48am UTC](https://www.ruby-forum.com/t/how-to-setup-nginx-as-reverse-proxy-tomcat-ssl/186084/2 "2010-03-31T10:48:59Z")
Hello! On Wed, Mar 31, 2010 at 04:09:42AM -0400, kaiyuan wrote: […] > My questions are > Can I have an SSL from Client to Nginx and another between > Nginx and Tomcat ，nginx verify the client certificate,and > also transfer the client certificate to tomcat,tomcat also > verify the client certificate. > > if nginx can do this,how to setup.Can someboby give me an > correct nginx.conf for this? This is not possible. To “transfer” client certificate one have to be able to access certificate’s private key. Moreover, nginx currently doesn’t support using client certificates in proxy connections at all. You may want to pass results of client cert verification ($ssl\_client\_s\_dn and so on) from nginx to tomcat in http headers instead. See here for details: > **[GitHub - nginxinc/nginx-wiki: ARCHIVED -- Source for the now archived NGINX Wiki...](https://github.com/nginxinc/nginx-wiki)** > > ARCHIVED -- Source for the now archived NGINX Wiki section of https://www.nginx.com > **[GitHub - nginxinc/nginx-wiki: ARCHIVED -- Source for the now archived NGINX Wiki...](https://github.com/nginxinc/nginx-wiki)** > > ARCHIVED -- Source for the now archived NGINX Wiki section of https://www.nginx.com Maxim D. ---
**Author:** ![kaiyuan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/47e85d/32.png) [@kaiyuan](https://www.ruby-forum.com/u/kaiyuan)\ **Post date:** [March 31, 2010, 11:41am UTC](https://www.ruby-forum.com/t/how-to-setup-nginx-as-reverse-proxy-tomcat-ssl/186084/3 "2010-03-31T11:41:40Z")
hi,axim Dounin that is a good idea. thank you very much! Posted at Nginx Forum: > **[Re: how to setup nginx as reverse proxy + tomcat ssl](https://forum.nginx.org/read.php?2,69690,69718#msg-69718)** > > Hey guys, I am totally new to Nginx, I need some advice with my reverse proxy setup. This is what i am trying to set up. Client(commit a client cert)\<========\>| Nginx (reverse proxy with ssl)|\<========\>Tomcat (with SSL and... ---
**Author:** ![kaiyuan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/47e85d/32.png) [@kaiyuan](https://www.ruby-forum.com/u/kaiyuan)\ **Post date:** [March 31, 2010, 11:48am UTC](https://www.ruby-forum.com/t/how-to-setup-nginx-as-reverse-proxy-tomcat-ssl/186084/4 "2010-03-31T11:48:06Z")
kaiyuan at 2010-3-31 17:40 wrote: > hi,axim Dounin > that is a good idea. > thank you very much > Maybe you can use my developing nginx\_tcp\_proxy\_module: > [GitHub - yaoweibin/nginx\_tcp\_proxy\_module: add the feature of tcp proxy with nginx, with health check and status monitor · GitHub](http://github.com/yaoweibin/nginx_tcp_proxy_module) > It should be helpful. – Weibin Y.