# Problem with Upstream over SSL

**URL:** <https://www.ruby-forum.com/t/problem-with-upstream-over-ssl/237905>\
**Category:** NGINX\
**Created:** [December 5, 2013, 3:45pm UTC](https://www.ruby-forum.com/t/problem-with-upstream-over-ssl/237905 "2013-12-05T15:45:36Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![musicdenotation](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/ea666f/32.png) [@musicdenotation](https://www.ruby-forum.com/u/musicdenotation)\
**Post date:** [December 5, 2013, 3:45pm UTC](https://www.ruby-forum.com/t/problem-with-upstream-over-ssl/237905/1 "2013-12-05T15:45:36Z")

</div>

I was proxying to an IIS server on 443 on nginx 1.1 on FreeBSD and it  
worked  
perfectly fine. We moved to nginx 1.4 running on ubuntu and now it  
won’t  
work.

The following works perfect:

server {  
location / {  
proxy\_pass [http://server.domain.com](http://server.domain.com)  
}  
}

But when I change it to

server {  
location / {  
proxy\_pass [https://server.domain.com](https://server.domain.com)  
}  
}

It times out. I can curl both http:// and https:// no problem. The  
strange  
thing is the log message with the timeout error is showing the IP  
instead of  
the hostname.

2013/12/05 09:30:33 [error] 20109#0: \*1 upstream timed out (110:  
Connection  
timed out) while reading response header from upstream, client:  
192.168.1.200, server: [external.domain.com](http://external.domain.com), request: “GET / HTTP/1.1”,  
upstream: “[https://192.168.1.10:443/](https://192.168.1.10:443/)”, host: “[external.domain.com](http://external.domain.com)”

What I’m guessing is nginx is trying to proxy to the host via the IP and  
then timing out because of SSL issues, as the SSL cert is not valid for  
the  
IP, only for the domain name.

Why is nginx proxying to the IP instead of the hostname? Can I force it  
to  
use the hostname?

Posted at Nginx Forum:

> **[Problem with Upstream over SSL](https://forum.nginx.org/read.php?2,245252,245252#msg-245252)**
>
> I was proxying to an IIS server on 443 on nginx 1.1 on FreeBSD and it worked perfectly fine. We moved to nginx 1.4 running on ubuntu and now it won't work. The following works perfect: server { location / { proxy\_pass http://server.domain.com

---

<div class="post-metadata">

**Author:** ![cschiewek](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/ac8455/32.png) [@cschiewek](https://www.ruby-forum.com/u/cschiewek)\
**Post date:** [December 5, 2013, 4:37pm UTC](https://www.ruby-forum.com/t/problem-with-upstream-over-ssl/237905/2 "2013-12-05T16:37:02Z")

</div>

Hello!

On Thu, Dec 05, 2013 at 09:44:55AM -0500, cschiewek wrote:

> }  
> thing is the log message with the timeout error is showing the IP instead of  
> the hostname.
> 
> 2013/12/05 09:30:33 [error] 20109#0: \*1 upstream timed out (110: Connection  
> timed out) while reading response header from upstream, client:  
> 192.168.1.200, server: [external.domain.com](http://external.domain.com), request: “GET / HTTP/1.1”,  
> upstream: “[https://192.168.1.10:443/](https://192.168.1.10:443/)”, host: “[external.domain.com](http://external.domain.com)”
> 
> What I’m guessing is nginx is trying to proxy to the host via the IP and  
> then timing out because of SSL issues, as the SSL cert is not valid for the  
> IP, only for the domain name.

The problem indeed may be related to SSL - e.g. something  
wrong with ciphers used. But it’s certainly not a certificate  
verification issue, as nginx currently doesn’t check upstream  
server certificates at all.

You may try using 1.5.x to play with proxy\_ssl\_protocols and  
proxy\_ssl\_ciphers directives introduced specificaly to help to  
resolve various interoperability problems.

> Why is nginx proxying to the IP instead of the hostname? Can I force it to  
> use the hostname?

The ip of a particular server nginx connects to is logged.

–  
Maxim D.  
[http://nginx.org/en/donation.html](http://nginx.org/en/donation.html)