# Upstream to both https or http

**URL:** <https://www.ruby-forum.com/t/upstream-to-both-https-or-http/205853>\
**Category:** NGINX\
**Created:** [April 17, 2011, 9:25am UTC](https://www.ruby-forum.com/t/upstream-to-both-https-or-http/205853 "2011-04-17T09:25:25Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![luislavena](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/0ea827/32.png) [@luislavena](https://www.ruby-forum.com/u/luislavena)\
**Post date:** [April 17, 2011, 9:25am UTC](https://www.ruby-forum.com/t/upstream-to-both-https-or-http/205853/1 "2011-04-17T09:25:25Z")

</div>

I have this requirement. I want to use nginx as the reverse proxy, which  
listen on address A and forward the request to the backend server with  
address B. However, if B is down, I want the request to be sent to  
address C. The question is, address B is https and address C is http.  
But for the argument of proxy\_pass module, I can only write one prefix  
(either “http” or “https”).

upstream backend {  
server :;  
server : backup;  
}

location / {  
proxy\_pass [http://backend](http://backend); #here, only one prefix is allowed  
}

So how to config to meet my requirements? Or here I shouldn’t use  
upstream but other approach?

Thanks.

Posted at Nginx Forum:

> **[Upstream to both https or http](https://forum.nginx.org/read.php?2,191822,191822#msg-191822)**
>
> I have this requirement. I want to use nginx as the reverse proxy, which listen on address A and forward the request to the backend server with address B. However, if B is down, I want the request to be sent to address C. The question is, address B...

---

<div class="post-metadata">

**Author:** ![speedfirst](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/e19adc/32.png) [@speedfirst](https://www.ruby-forum.com/u/speedfirst)\
**Post date:** [April 17, 2011, 9:40am UTC](https://www.ruby-forum.com/t/upstream-to-both-https-or-http/205853/2 "2011-04-17T09:40:51Z")

</div>

On Sun, Apr 17, 2011 at 2:24 PM, speedfirst [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
wrote:

> I have this requirement. I want to use nginx as the reverse proxy, which  
> listen on address A and forward the request to the backend server with  
> address B. However, if B is down, I want the request to be sent to  
> address C. The question is, address B is https and address C is http.  
> But for the argument of proxy\_pass module, I can only write one prefix  
> (either “http” or “https”).

you’re not supposed to proxy to https backend. And I don’t know how  
mixed environment like that would work anyway. If the client isn’t  
using SSL then what’s the point. But then if it’s SSL then who  
supposed to give out the certificate.

---

<div class="post-metadata">

**Author:** ![speedfirst](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/e19adc/32.png) [@speedfirst](https://www.ruby-forum.com/u/speedfirst)\
**Post date:** [April 17, 2011, 11:25am UTC](https://www.ruby-forum.com/t/upstream-to-both-https-or-http/205853/3 "2011-04-17T11:25:38Z")

</div>

Hello!

On Sun, Apr 17, 2011 at 03:24:57AM -0400, speedfirst wrote:

> }
> 
> location / {  
> proxy\_pass [http://backend](http://backend); #here, only one prefix is allowed  
> }
> 
> So how to config to meet my requirements? Or here I shouldn’t use  
> upstream but other approach?

```
location / {
    proxy_pass https://B;
    error_page 502 504 = @fallback;
}

location @fallback {
    proxy_pass http://C;
}

```

Maxim D.

---

<div class="post-metadata">

**Author:** ![speedfirst](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/e19adc/32.png) [@speedfirst](https://www.ruby-forum.com/u/speedfirst)\
**Post date:** [April 17, 2011, 2:19pm UTC](https://www.ruby-forum.com/t/upstream-to-both-https-or-http/205853/4 "2011-04-17T14:19:01Z")

</div>

huge overhead in the handshaking and encryption to the backend.

On Sun, Apr 17, 2011 at 10:17 PM, Peter Portante  
\<removed\_email\_address@domain.invalid

---

<div class="post-metadata">

**Author:** ![speedfirst](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/e19adc/32.png) [@speedfirst](https://www.ruby-forum.com/u/speedfirst)\
**Post date:** [April 17, 2011, 2:17pm UTC](https://www.ruby-forum.com/t/upstream-to-both-https-or-http/205853/5 "2011-04-17T14:17:47Z")

</div>

Can somebody explain more about why you are “not supposed to” proxy to  
https  
backend?

Are you saying because it does not buy you anything since Nginx  
terminates  
the SSL protocol?

---

<div class="post-metadata">

**Author:** ![speedfirst](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/e19adc/32.png) [@speedfirst](https://www.ruby-forum.com/u/speedfirst)\
**Post date:** [April 17, 2011, 11:26pm UTC](https://www.ruby-forum.com/t/upstream-to-both-https-or-http/205853/6 "2011-04-17T23:26:55Z")

</div>

Hello,

On Sun, Apr 17, 2011 at 5:24 AM, Maxim D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
wrote:

> > upstream but other approach?  
> > Maxim D.
> 
> * * *
> 
> nginx mailing list  
> [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
> [mailman.nginx.org archive](http://nginx.org/mailman/listinfo/nginx)

So we would like to be able to have one set of common definitions for  
locations that work under SSL and non-SSL where we “pass along” the SSL  
nature of the connection (let’s not get into the discussion of whether  
or if  
that is a good idea or not).

Today we have:

upstream backend\_ssl {  
server :;  
server :;  
}

upstream backend {  
server :;  
server :;  
}

server {  
listen 443 ssl;  
.  
.  
.  
location / {  
proxy\_pass https://backed\_ssl  
}  
}

server {  
listen 80;  
.  
.  
.  
location / {  
proxy\_pass [https://backend](https://backend)  
}  
}

We’d like to have something like:

upstream backend {  
server :;  
server :;  
}

server {  
listen 8080;  
listen 8443 ssl;  
.  
.  
.  
location / {  
proxy\_pass $scheme://backend  
}  
}

Where the upstream servers don’t listen on 8080 or 8443, but some other  
set  
of ports (like 7080 & 7443).

Doable?

Thanks, -peter