# Nginx as fwd-proxy to an https server

**URL:** <https://www.ruby-forum.com/t/nginx-as-fwd-proxy-to-an-https-server/218055>\
**Category:** NGINX\
**Created:** [March 19, 2012, 11:29pm UTC](https://www.ruby-forum.com/t/nginx-as-fwd-proxy-to-an-https-server/218055 "2012-03-19T23:29:00Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![luislavena](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/0ea827/32.png) [@luislavena](https://www.ruby-forum.com/u/luislavena)\
**Post date:** [March 19, 2012, 11:29pm UTC](https://www.ruby-forum.com/t/nginx-as-fwd-proxy-to-an-https-server/218055/1 "2012-03-19T23:29:00Z")

</div>

If I understood well, the ‘normal’ setup is to  
let the client talk via https to nginx and to have all servers  
behind nginx talk plain http.

web client --https–\> nginx --http–\> another server

However I have one setup, where I’d like to have an encrypted  
communication between nginx and one of the other servers (which cannot  
be reached directly by the web client)

web client --https–\> nginx --https–\> another server

Nginx may be able to intercept (decrypt) the request (no security issue  
for the given setup), but it would also be fine if nginx wouldn’t be  
able to decrypt the communication.

The remote server is also running nginx, but has however another  
certificate.

Any suggestions / recommendations for such a setup?

---

<div class="post-metadata">

**Author:** ![Gelonida\_N](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/65b543/32.png) [@Gelonida\_N](https://www.ruby-forum.com/u/Gelonida_N)\
**Post date:** [March 20, 2012, 12:05am UTC](https://www.ruby-forum.com/t/nginx-as-fwd-proxy-to-an-https-server/218055/2 "2012-03-20T00:05:29Z")

</div>

On Mon, 2012-03-19 at 23:28 +0100, Gelonida N wrote:

> If I understood well, the ‘normal’ setup is to  
> let the client talk via https to nginx and to have all servers  
> behind nginx talk plain http.

> However I have one setup, where I’d like to have an encrypted  
> communication between nginx and one of the other servers (which cannot  
> be reached directly by the web client)
> 
> web client --https–\> nginx --https–\> another server

This is perfectly normal too, although probably less common.

> Nginx may be able to intercept (decrypt) the request (no security issue  
> for the given setup), but it would also be fine if nginx wouldn’t be  
> able to decrypt the communication.

Nginx will need to decrypt the data in order to re-encrypt it for the  
second leg.

> The remote server is also running nginx, but has however another  
> certificate.

Won’t matter.

> Any suggestions / recommendations for such a setup?

It is just as you described. Just use https:// as the scheme rather  
than http:// in your proxy\_pass directive.

Regards,  
Cliff