15

Trying to setup Nginx as load balancer for https servers. The upstream serves over port 443 with SSL certificates configured. How to configure Nginx, so that the SSL certificate configuration is handled only on the upstream servers and not in the Nginx server?

1
  • 1
    Could you please post the configuration which solved it? Dec 7, 2013 at 11:05

3 Answers 3

15

You need to use Upstream module, and Reverse Proxy module. To reverse proxy to the https upstream, use this

proxy_pass  https://backend;

where backend is an uptream block.

However, if I were doing this, I'd terminate ssl on the nginx server, and make upstream app servers doing what they are good at: serving the content, instead of worrying about ssl encryption/decryption overhead. Setting up ssl termination on nginx is also very simple using the SSL module. A very good case study is also given here.

5
  • 1
    Any sample configuration? I'm getting "ssl_error_rx_record_too_long" to browser and nothing in NGINX error log. Dec 6, 2013 at 13:18
  • Does this SO answer fix your problem? serverfault.com/questions/497430/…
    – Chuan Ma
    Dec 7, 2013 at 2:31
  • 1
    No, I have tried that. The config file in that sample defines SSL certificates which I'm not doing (because there are none on the NGINX server). Dec 7, 2013 at 11:02
  • 1
    Is the upstream module also necessary when not trying to load balance, but purely proxying to one backend? Can I simply spell out proxy_pass https://example.com?
    – Joost
    May 30, 2016 at 11:12
  • 1
    OP is asking for "...not on the Nginx server", thus what he wants is SSL pass-through; you are suggesting upstream SSL reverse-proxying; where'd have to setup SSL certificates on Nginx as well. Apr 15, 2018 at 21:02
5

seems now possible according to https://www.nginx.com/resources/admin-guide/nginx-tcp-ssl-upstreams/ (1.9.4+)

4

As far as I understood from reading relevant discussion on Nginx forum, this is not possible because Nginx needs to terminate upstream SSL connection anyway. If you insist on using Nginx you're left only to replicate SSL configuration and make certificates and key available to Nginx.

The discussion I linked concluded that HAProxy is much better tool for SSL upstream passthrough. Here's relevant post I've found about configuring HAProxy for such purpose. Because I have zero HAProxy experience I can't summarise its configuration or general viability of the solution leaving it to the reader.

Update

Since 1.9.2 Nginx supports HAProxy's proxy protocol.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.