nginx: Setup SSL Reverse Proxy (Load Balanced SSL Proxy)

A reverse proxy is a proxy server that is installed in a server network. Typically, reverse proxies are used in front of Web servers such as Apache, IIS, and Lighttpd. How do I setup nginx web server as SSL reverse proxy?

When you’ve multiple backend web servers, encryption / SSL acceleration can be done by a reverse proxy. Nginx can act as SSL acceleration software. It provided the following benefits:

  • Easy of use : Nginx is easy to setup and upgrade.
  • Security : Nginx provide an additional layer of defense as Apache is behind the proxy. It can protect against common web-based attacks too.
  • Load Distribution : nginx use very little memory and can distribute the load to several Apache servers. It can even rewrite urls on fly.
  • Caching : Nginx act as a reverse proxy which offload the Web servers by caching static content, such as images, css, js, static html pages and much more.
  • Compression : Nginx can optimize and compress the content to speed up the load time.


Our Sample Setup

    =============                               |---- apache1 (
    | ISP Router|                               |
    =============                               |---- apache2 (
         |                                      |
         |                                      |---- db1 (
         |      |eth0 -> ----------/
         |-lb0==|                          /
         |      |eth1 ->
         |      |eth0 -> ----------\
         |-lb1==|                          /    |---- apache1 (
                |eth1 ->     |
                                                |---- apache2 (
                                                |---- db1 (
  • lb0 – Linux box directly connected to the Internet via eth1. This is master SSL load balancer.
  • lb1 – Linux box directly connected to the Internet via eth1. This is backup SSL load balancer. This will become active if master networking failed.
  • A virtual IP address that moves between lb0 and lb1. It is managed by keepalived.
  • nginx – It is installed on lb0 and lb1.
  • SSL Certificate – You need to install ssl certificates on lb0 and lb1.

For demonstration purpose I’m going to use Self-signed SSL certificate, but you can use real SSL certificate signed by CAs.

+------+	+-------------+	       +-------------------+
|Client|  <---> |SSL-Nginx:443|	<----> |Apache-HTTP_mode:80|
+------+        +-------------+        +-------------------+
  • You’ve the SSL connection between client and Nginx.
  • Then Nginx act as proxy server and makes unencrypted connection to Apache at port 80.
  • Nginx can cache all static file and other files.

Generating Self-signed Certificate

First, create required directories:
# cd /usr/local/nginx/conf
# mkdir ssl
# cd ssl

To create a private key, enter:
# openssl genrsa -des3 -out 1024
Sample outputs:

Fig.01: OpenSSL - Create a Private Key
To create a CSR (Certificate Signing Request):
# openssl req -new -key -out
Sample outputs:

Fig.02: OpenSSL - Create a CSR (Certificate Signing Request)
Please enter your domain name that you want to associate with the certificate. For example, for the Command Name I entered as I’m going to use

How Do I Remove The Passphrase? (Optional)

You can remove the passphrase so nginx can start on boot without entering the passphrase. Type the following commands
# cp
# openssl rsa -in -out

Finally, you should see three files as follows (note I’ve created all files as vivek user and than moved lb0 and lb1 server /usr/local/ngnix/conf/ssl/ directory):
# ls -l
Sample outputs:

Fig.03: All the files in ssl directory
# openssl x509 -req -days 365 -in -signkey -out
Sample outputs:

Fig.04: Generating The Actual Self-signed  SSL Certificate

How Do I Copy SSL Certificates Files To lb1?

You need to copy those files to lb1, enter:
# ssh root@lb1 mkdir /usr/local/ngnix/conf/ssl
# rsync -av /usr/local/ngnix/conf/ssl/* root@lb1:/usr/local/ngnix/conf/ssl/

Configure Nginx As SSL Reverse Proxy (lb0 and lb1)

Edit nginx.conf, enter (you need to edit files on both lb0 and lb1):
# vi /usr/local/ngnix/conf/nginx.conf
Edit / append as follows:

server {
	### server port and name ###
	ssl 		on;
	### SSL log files ###
        access_log      logs/ssl-access.log;
        error_log       logs/ssl-error.log;
	### SSL cert files ###
        ssl_certificate      ssl/;
        ssl_certificate_key  ssl/;
	### Add SSL specific settings here ###
	ssl_protocols        SSLv3 TLSv1 TLSv1.1 TLSv1.2;
	ssl_ciphers RC4:HIGH:!aNULL:!MD5;
     	ssl_prefer_server_ciphers on;
     	keepalive_timeout    60;
	ssl_session_cache    shared:SSL:10m;
     	ssl_session_timeout  10m;
	### We want full access to SSL via backend ###
     	location / {
	        proxy_pass  http://nixcraft;
		### force timeouts if one of backend is died ##
        	proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
		### Set headers ####
                proxy_set_header        Accept-Encoding   "";
	        proxy_set_header        Host            $host;
	        proxy_set_header        X-Real-IP       $remote_addr;
	        proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
		### Most PHP, Python, Rails, Java App can use this header ###
		#proxy_set_header X-Forwarded-Proto https;##
		#This is better##
	        proxy_set_header        X-Forwarded-Proto $scheme;
		add_header              Front-End-Https   on;
		### By default we don't want to redirect it ####
	        proxy_redirect     off;

Save and close the file. Reload nginx:
# /usr/local/nginx/sbin/nginx -t
# /usr/local/nginx/sbin/nginx -s reload

Verify port is opened:
# netstat -tulpn | grep :443

How Do I Test And Debug SSL Certificates From The Shell Prompt?

Use the openssl command as follows:
$ openssl s_client -connect
Or better use the following command:
$ openssl s_client -connect -CApath /usr/share/ssl-cert/ -servername

How Do I Cache Common Files?

Edit nginx.conf and add as follows to cache common files:

location ~* \.(jpg|png|gif|jpeg|css|js|mp3|wav|swf|mov|doc|pdf|xls|ppt|docx|pptx|xlsx)$ {
        proxy_buffering           on;
        proxy_cache_valid 200 120m;
        expires 864000;

Save and close the file. Reload nginx:
# nginx -s reload