# Nginx as SSL terminating server

**URL:** <https://www.ruby-forum.com/t/nginx-as-ssl-terminating-server/192294>\
**Category:** NGINX\
**Created:** [July 27, 2010, 9:12pm UTC](https://www.ruby-forum.com/t/nginx-as-ssl-terminating-server/192294 "2010-07-27T21:12:08Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![joshua](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/48db29/32.png) [@joshua](https://www.ruby-forum.com/u/joshua)\
**Post date:** [July 27, 2010, 9:12pm UTC](https://www.ruby-forum.com/t/nginx-as-ssl-terminating-server/192294/1 "2010-07-27T21:12:08Z")

</div>

We have the following setup:

firewall → single nginx instance (SSL termination) → haproxy →   
multiple nginx/unicorn instances (via unix socket)

Is it recommendable to turn request buffering off at the first nginx?  
Ideally things like uploads would be buffered at the final nginx  
instances. The first one is only there to terminate SSL and pass  
requests on to haproxy.

Thanks,  
Joshua Sierles

Posted at Nginx Forum:

> **[nginx as SSL terminating server](https://forum.nginx.org/read.php?2,113599,113599#msg-113599)**
>
> We have the following setup: firewall --\> single nginx instance (SSL termination) --\> haproxy --\> multiple nginx/unicorn instances (via unix socket) Is it recommendable to turn request buffering off at the first nginx? Ideally things like...

---

<div class="post-metadata">

**Author:** ![joshua](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/48db29/32.png) [@joshua](https://www.ruby-forum.com/u/joshua)\
**Post date:** [July 29, 2010, 12:06am UTC](https://www.ruby-forum.com/t/nginx-as-ssl-terminating-server/192294/2 "2010-07-29T00:06:45Z")

</div>

Quite simply: no.

You cannot stop the first nginx from buffering requests. You can (and  
should!) stop it from buffering responses with the proxy\_buffering  
directive:

proxy\_buffering off;

I have a similar setup (minus the haproxy layer,  
passenger\_global\_queue is good enough) and would also like to do this.  
I’ve tried messing with the proxy buffer sizes but it doesn’t seem to  
make any significant difference with large uploads and opens up DoS  
opportunities.