# Proxy to upstream HTTPS server \*without\* any keys/certs in nginx

**URL:** <https://www.ruby-forum.com/t/proxy-to-upstream-https-server-without-any-keys-certs-in-nginx/246274>\
**Category:** NGINX\
**Created:** [September 24, 2013, 7:56pm UTC](https://www.ruby-forum.com/t/proxy-to-upstream-https-server-without-any-keys-certs-in-nginx/246274 "2013-09-24T19:56:00Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rafa\_F](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/958977/32.png) [@Rafa\_F](https://www.ruby-forum.com/u/Rafa_F)\
**Post date:** [September 24, 2013, 7:56pm UTC](https://www.ruby-forum.com/t/proxy-to-upstream-https-server-without-any-keys-certs-in-nginx/246274/1 "2013-09-24T19:56:00Z")

</div>

Hello,

We are researching which tools would allow us to do what is described in  
the subject.

After searching the archives here and in other places like  
stackoverflow,  
there seems to be conflicting info on whether this is possible. Perhaps  
it  
was not doable early in nginx’s life but is now? Based on the below  
link  
(which notes the upstream and reverse proxy modules), can we now have  
nginx  
listen on 443, and pass browser requests to it on to an upstream HTTPS  
server which actually serves content, has the certs/keys and takes care  
of  
SSL handshake etc? In our use case we cannot house any keys/certs on  
the  
nginx box so must proxy everything (including SSL) to the upstream https  
box, as if the end user (who makes the request from the browser) hit the  
upstream server directly, and doesn’t have any missing or mismatching  
certificate errors.

> <https://stackoverflow.com/questions/15394904/nginx-load-balance-with-upstream-ssl/15400260#15400260>

I hope my question is clear. Thanks for your help.

Gary

---

<div class="post-metadata">

**Author:** ![Gary\_Chodos](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/3ec8ea/32.png) [@Gary\_Chodos](https://www.ruby-forum.com/u/Gary_Chodos)\
**Post date:** [September 24, 2013, 8:24pm UTC](https://www.ruby-forum.com/t/proxy-to-upstream-https-server-without-any-keys-certs-in-nginx/246274/2 "2013-09-24T20:24:39Z")

</div>

On 24 Sep 2013 18:55, “Gary Chodos” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Hello,
> 
> We are researching which tools would allow us to do what is described in  
> the subject.
> 
> After searching the archives here and in other places like stackoverflow,  
> there seems to be conflicting info on whether this is possible. Perhaps  
> it  
> was not doable early in nginx’s life but is now? Based on the below  
> link  
> (which notes the upstream and reverse proxy modules), can we now have  
> nginx  
> listen on 443, and pass browser requests to it on to an upstream HTTPS  
> server which actually serves content, has the certs/keys and takes care  
> of  
> SSL handshake etc?

I don’t believe so, no.

> In our use case we cannot house any keys/certs on the nginx box so  
> must proxy everything (including SSL) to the upstream https box, as if  
> the  
> end user (who makes the request from the browser) hit the upstream  
> server  
> directly, and doesn’t have any missing or mismatching certificate  
> errors.

It sounds like you just need a TCP-layer proxy. I suggest HAProxy in TCP  
mode.

> 

[http://stackoverflow.com/questions/15394904/nginx-load-balance-with-upstream-ssl/15400260#15400260](http://stackoverflow.com/questions/15394904/nginx-load-balance-with-upstream-ssl/15400260#15400260)

I don’t believe the answer there is correct. I don’t believe you can  
reverse-proxy an SSL connection into nginx without terminating it first,  
using local certs.

I will happily be shown I’m wrong, however 🙂

HTH,  
Jonathan

---

<div class="post-metadata">

**Author:** ![Gary\_Chodos](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/3ec8ea/32.png) [@Gary\_Chodos](https://www.ruby-forum.com/u/Gary_Chodos)\
**Post date:** [September 25, 2013, 4:58pm UTC](https://www.ruby-forum.com/t/proxy-to-upstream-https-server-without-any-keys-certs-in-nginx/246274/3 "2013-09-25T16:58:19Z")

</div>

On Tuesday, September 24, 2013, Jonathan M. wrote:

> possible. Perhaps it was not doable early in nginx’s life but is now?  
> directly, and doesn’t have any missing or mismatching certificate errors.
> 
> It sounds like you just need a TCP-layer proxy. I suggest HAProxy in TCP  
> mode.

Bingo! This works perfectly. Thanks.

Gary