Lets say that I have an nginx reverse proxy that proxies the traffic to a Tomcat on the same server. I think the most common way to configure this setup is to enable SSL on nginx and then proxy the unencrypted traffic to Tomcat. So far so good. The traffic starts to grow and I decide to move the tomcat to a different server for performance related reasons. Now the connection between the nginx and the Tomcat is unsecure (http).
How should I prepare for this security concern? Should I tunnel the traffic through an SSH tunnel from nginx server to the Tomcat? My servers could be located in a cloud service so the connection between them is not secure (to my knowledge).