# NGINX SSL passthrough without certificate **URL:** \ **Category:** NGINX\ **Created:** [September 5, 2014, 10:05am UTC](https://www.ruby-forum.com/t/nginx-ssl-passthrough-without-certificate/231906 "2014-09-05T10:05:10Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![addis\_a](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/c4cdca/32.png) [@addis\_a](https://www.ruby-forum.com/u/addis_a)\ **Post date:** [September 5, 2014, 10:05am UTC](https://www.ruby-forum.com/t/nginx-ssl-passthrough-without-certificate/231906/1 "2014-09-05T10:05:10Z")
We currently have a backend server that listens for SSL requests, and (using SNI) chooses to pass them on to the correct place, or alternatively will serve the requested HTTPS. Our current configuration is slow (not painfully, just slower than we’d like), and we figured having NGINX do some of the work would speed things up. Can NGINX pass through some HTTPS requests (by domain) without modifying anything (by checking SNI in the initial packet)? Most (all?) websites indicate that I should decode and encode the traffic (which is not be possible because of cases such as [https://google.com/](https://google.com/)). So ultimately, what would be ideal for us is: 1. NGINX sits on network boundary, listening for SSL/TLS connections 2. When a new connection comes in, NGINX decides to pass on the TLS connection without touching it OR serve it as a regular HTTPS website (OR depends on domain) Lastly, is there any current way to achieve X-FORWARDED-FOR with HTTPS? I understand it can’t go into the actual HTTPS request, but figured it could be sent BEFORE the HTTPS decode packet. (the receiving end would have to understand this also) Posted at Nginx Forum: > **[NGINX SSL passthrough without certificate](https://forum.nginx.org/read.php?2,253088,253088#msg-253088)** > > We currently have a backend server that listens for SSL requests, and (using SNI) chooses to pass them on to the correct place, or alternatively will serve the requested HTTPS. Our current configuration is slow (not painfully, just slower than we'd... ---
**Author:** ![OzJD](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/o/839c29/32.png) [@OzJD](https://www.ruby-forum.com/u/OzJD)\ **Post date:** [September 5, 2014, 10:16am UTC](https://www.ruby-forum.com/t/nginx-ssl-passthrough-without-certificate/231906/2 "2014-09-05T10:16:09Z")
Hi, > indicate that I should decode and encode the traffic (which is not be > be sent BEFORE the HTTPS decode packet. (the receiving end would have to > understand this also) For all those things, haproxy is way more adequate. Regards, Lukas ---
**Author:** ![OzJD](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/o/839c29/32.png) [@OzJD](https://www.ruby-forum.com/u/OzJD)\ **Post date:** [September 5, 2014, 12:23pm UTC](https://www.ruby-forum.com/t/nginx-ssl-passthrough-without-certificate/231906/3 "2014-09-05T12:23:07Z")
Hi, > Hi Lukas, > > While HAProxy is able to do some of those things (not sure about > X-FORWARDED-FOR workarounds?) Yes, haproxy supports and pushes the PROXY protocol for this exact reason. > I’d still prefer to use NGINX where possible > (for other reasons, such as PageSpeed support, etc) Well, you can’t use PageSpeed if you forward SSL encrypted TCP traffic, can you? Perhaps you need a combination between the two? For example, SNI based routing on a first (HAProxy) layer, passing the SSL encrypted traffic either to nginx, for decryption/pagepspeed, etc or directly to a backend (based on SNI). > Is NGINX able to do any of the things mentioned in the question? I don’t think so, mainly because nginx’ focus is http/https, not TCP forwarding. Regards, Lukas ---
**Author:** ![OzJD](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/o/839c29/32.png) [@OzJD](https://www.ruby-forum.com/u/OzJD)\ **Post date:** [September 5, 2014, 1:54pm UTC](https://www.ruby-forum.com/t/nginx-ssl-passthrough-without-certificate/231906/4 "2014-09-05T13:54:39Z")
Lukas, I think you’re right. The combination of three may be optimal at this time. I’ll see what I come up with - I hadn’t heard of the PROXY protocol before (was thinking of something similar though). That’s made my life plenty easier! Thanks mate 🙂 Posted at Nginx Forum: > **[Re: RE: NGINX SSL passthrough without certificate](https://forum.nginx.org/read.php?2,253088,253095#msg-253095)** > > We currently have a backend server that listens for SSL requests, and (using SNI) chooses to pass them on to the correct place, or alternatively will serve the requested HTTPS. Our current configuration is slow (not painfully, just slower than we'd... ---
**Author:** ![OzJD](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/o/839c29/32.png) [@OzJD](https://www.ruby-forum.com/u/OzJD)\ **Post date:** [September 5, 2014, 11:43am UTC](https://www.ruby-forum.com/t/nginx-ssl-passthrough-without-certificate/231906/5 "2014-09-05T11:43:26Z")
Hi Lukas, While HAProxy is able to do some of those things (not sure about X-FORWARDED-FOR workarounds?), I’d still prefer to use NGINX where possible (for other reasons, such as PageSpeed support, etc) Is NGINX able to do any of the things mentioned in the question? Specifically, can it sort by SNI hostname without becoming an SSL endpoint? If not, is there a reason why? (has it been decided by the community that it’s not a good idea, or it just hasn’t been developed?) I’ve seen a few similar questions around, but no definitive answer. Thanks, OzJD Posted at Nginx Forum: > **[Re: RE: NGINX SSL passthrough without certificate](https://forum.nginx.org/read.php?2,253088,253090#msg-253090)** > > We currently have a backend server that listens for SSL requests, and (using SNI) chooses to pass them on to the correct place, or alternatively will serve the requested HTTPS. Our current configuration is slow (not painfully, just slower than we'd... ---
**Author:** ![OzJD](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/o/839c29/32.png) [@OzJD](https://www.ruby-forum.com/u/OzJD)\ **Post date:** [September 5, 2014, 4:14pm UTC](https://www.ruby-forum.com/t/nginx-ssl-passthrough-without-certificate/231906/6 "2014-09-05T16:14:28Z")
One most imporatant thing, we site working with https from 2 months but after configuer the sftp with openssl , it created the problem. i did the old settings of sshd\_config, as it is as its worked, but still facing the issue. Posted at Nginx Forum: > **[Re: urgent need help ,ssl error ;](https://forum.nginx.org/read.php?2,253088,253099#msg-253099)** > > We currently have a backend server that listens for SSL requests, and (using SNI) chooses to pass them on to the correct place, or alternatively will serve the requested HTTPS. Our current configuration is slow (not painfully, just slower than we'd... ---
**Author:** ![OzJD](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/o/839c29/32.png) [@OzJD](https://www.ruby-forum.com/u/OzJD)\ **Post date:** [September 5, 2014, 4:11pm UTC](https://www.ruby-forum.com/t/nginx-ssl-passthrough-without-certificate/231906/7 "2014-09-05T16:11:25Z")
Hi Team, I am facing a issue regarding the ssl in nginx , find below the error logs : 2014/09/05 19:23:36 [emerg] 18774#0: SSL\_CTX\_use\_PrivateKey\_file(“/etc/nginx/ssl/server.crt”) failed (SSL: error:0906D06C:PEM routines:PEM\_read\_bio:no start line error:140B0009:SSL routines:SSL\_CTX\_use\_PrivateKey\_file:PEM lib) 2014/09/05 19:23:36 [emerg] 18775#0: SSL\_CTX\_use\_PrivateKey\_file(“/etc/nginx/ssl/server.crt”) failed (SSL: error:0906D06C:PEM routines:PEM\_read\_bio:no start line error:140B0009:SSL routines:SSL\_CTX\_use\_PrivateKey\_file:PEM lib) 2014/09/05 19:26:51 [emerg] 18977#0: SSL\_CTX\_use\_PrivateKey\_file(“/etc/nginx/ssl/server.crt”) failed (SSL: error:0906D06C:PEM routines:PEM\_read\_bio:no start line error:140B0009:SSL routines:SSL\_CTX\_use\_PrivateKey\_file:PEM lib) 2014/09/05 19:26:51 [emerg] 18978#0: SSL\_CTX\_use\_PrivateKey\_file(“/etc/nginx/ssl/server.crt”) failed (SSL: error:0906D06C:PEM routines:PEM\_read\_bio:no start line error:140B0009:SSL routines:SSL\_CTX\_use\_PrivateKey\_file:PEM lib) had donethe google but can’t resolve, only you guies can help me, its very urgent. Thank & Regards Vijay kr removed\_email\_address@domain.invalid Posted at Nginx Forum: > **[urgent need help ,ssl error ;](https://forum.nginx.org/read.php?2,253088,253098#msg-253098)** > > We currently have a backend server that listens for SSL requests, and (using SNI) chooses to pass them on to the correct place, or alternatively will serve the requested HTTPS. Our current configuration is slow (not painfully, just slower than we'd... ---
**Author:** ![OzJD](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/o/839c29/32.png) [@OzJD](https://www.ruby-forum.com/u/OzJD)\ **Post date:** [September 7, 2014, 2:53am UTC](https://www.ruby-forum.com/t/nginx-ssl-passthrough-without-certificate/231906/8 "2014-09-07T02:53:36Z")
“no start line error” is pretty specific. The first line with any text on should read -----BEGIN CERTIFICATE----- with 5 dashes before and after the text. On Fri, 2014-09-05 at 10:11 -0400, vk1dadhich wrote: > 2014/09/05 19:23:36 [emerg] 18775#0: > routines:SSL\_CTX\_use\_PrivateKey\_file:PEM lib) > > * * * > > nginx mailing list > [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) > [mailman.nginx.org archive](http://mailman.nginx.org/mailman/listinfo/nginx) – Steve H. BSc(Hons) MIITP > **[Linux & Admin Support Services | "Services provided by people who are proud...](https://www.greengecko.co.nz/)** > > Offers linux support services, systems and database administration, consultancy and the full development lifecycle for open source - based solutions Linkedin: [Steve Holdoway - Robotron New Zealand Limited | LinkedIn](http://www.linkedin.com/in/steveholdoway) Skype: sholdowa ---
**Author:** ![OzJD](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/o/839c29/32.png) [@OzJD](https://www.ruby-forum.com/u/OzJD)\ **Post date:** [September 5, 2014, 4:15pm UTC](https://www.ruby-forum.com/t/nginx-ssl-passthrough-without-certificate/231906/9 "2014-09-05T16:15:41Z")
* * * nginx mailing list removed\_email\_address@domain.invalid [http://mailman.nginx.org/mailman/listinfo/nginx](http://mailman.nginx.org/mailman/listinfo/nginx)