This question already has an answer here:
I have a few applications that serve HTTP content on localhost. I have installed apache and configured reverse proxy so that apache routes all the traffic to the underlying applications based on URL patterns.
Then I ran cert-bot and installed an SSL certificate from Let's Encrypt.
Only apache knows about SSL and HTTPS.
Is this secure? Am I doing anything wrong?
Is it more secure if my applications handle SSL or can I let apache take care of it?
I know that anyone inside my server can bypass SSL of course. I dont consider that a problem.