For my private VPS, I am building a configuration for different web applications (Owncloud,...) which depends on a combination of different Docker containers. At the front, I would like to use an nginx web service as a reverse proxy that forwards incoming HTTP requests depending on the
request-uri to the web services "behind".
To build up such a setting using HTTPS, nginx needs client certificates for the so called upstream services, which are located behind the proxy. My question is now, from a security point of view, if it is necessary to use certificates that are signed by a CA. My idea is that the nginx reverse proxy itself is reachable by a domain which is secured by a Let's Encrypt certificate (or another certificate signed by a trusted CA). If I now call
https://example.com/owncloud, this is forwarded to the application container for Owncloud which is located on the same VPS. Nginx now needs a client certificate which I would like to create as self signed according to the fact is is an internal communication on just one physical system between those containers.
Could you guys give me some advice about the setting and about my security perspective about this topic? Did I forget some points in my conception?