How to integrate client certificates for upstream servers with nginx as reverse proxy?

Question

For my private VPS, I am building a configuration for different web applications (Owncloud,...) which depends on a combination of different Docker containers. At the front, I would like to use an nginx web service as a reverse proxy that forwards incoming HTTP requests depending on the request-uri to the web services "behind".

To build up such a setting using HTTPS, nginx needs client certificates for the so called upstream services, which are located behind the proxy. My question is now, from a security point of view, if it is necessary to use certificates that are signed by a CA. My idea is that the nginx reverse proxy itself is reachable by a domain which is secured by a Let's Encrypt certificate (or another certificate signed by a trusted CA). If I now call https://example.com/owncloud, this is forwarded to the application container for Owncloud which is located on the same VPS. Nginx now needs a client certificate which I would like to create as self signed according to the fact is is an internal communication on just one physical system between those containers.

Could you guys give me some advice about the setting and about my security perspective about this topic? Did I forget some points in my conception?

Answer 1

From my understanding you have

VPS with Docker w/ domain name `my-domain` [
  docker-mysql hosting intern ????
  docker-owncloud hosting intern 3000 and internal connect docker-sql
  docker-nginx hosting extern 80/443 and internal connect docker-owncloud:3000)
]

you have 2x options:

• my-domain/owncloud-subfolder
• owncloud-subdomain.my-domain

If you wanted to go the subfolder route, it is possible to use your my-domain cert as is. If you are going the subfolder route you would simply set owncloud up as HTTP (not https) and then use location {} to proxy_pass from nginx to docker-owncloud

location /owncloud-subfolder/ {
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_pass http://docker-owncloud:3000;
    }

My personal pref is that it is easier to setup sub-domains and manage lets-encrypt certs for each of them eg:

ca.ffeineaddiction.com
gogs.ca.ffeineaddiction.com
own.ca.ffeineaddiction.com

in my case ffeineaddiction.com is my vps (vultr) and gogs.* and own.* are mapped to a physical server w/ 2TB of storage via tinc (tutorial on tinc setup)

EDIT:

Re-read the question which is apparently different then what I understood it to be the first time. If I am understanding correctly now you are not worried about the external certs that Nginx is hosting but rather the Clientside cert in Nginx to connect to HTTPS instance of owncloud on 127.0.0.1 ... in my setup my solution to this is to not have one ... I simply use HTTP between OwnCloud and Nginx since its all internal to the box (or over TINC in my case).

Answer 2

I think you are correct. In fact, using self-signed certificates within your security boundary can be more secure as long as you are managing your root CA certificate correctly (e.g. keeping it offline and secured).

There is no reason for internal resources to use an externally verified certificate from a public CA.