0

Let's say I have a Server A with a valid certificate and a Server B with the key for the certificate.

Client === Nginx Proxy with valid cert === Apache with key

I don't want Ngnix to decrypt all traffic like a MITM. Nginx should pass all encrypted traffic to Apache without leaking the IP-Address of Apache.

If that is possible how do I now set up a "reverse Proxy" with nginx and apache as the upstream server?

  • I want to answer this, but its obviously a question about trying to protect something. Are you trying to protect the key? Are you trying to protect a server? Can you be more specific as to what you would like to do? At a high level, there are definitely technologies and paths that you could use to manage this. For example, you could have a public facing server that leverages a secure API to call in a back end. You could leverage an HSM to host the key. It all comes down to your use case. – Connor Peoples Jan 8 at 1:50
1

I don't want Ngnix to decrypt all traffic like a MITM. Nginx should pass all encrypted traffic to Apache without leaking the IP-Address of Apache.

In this case you don't want to have a (reverse) proxy for HTTP but you just want to pass the data stream without any changes at the TCP level to the real host. nginx can do this with the stream backend.

Note that this does not make nginx serve the certificate and Apache the key. Instead Apache has both the certificate and key and nginx none of these. Since the certificate is not bound to an IP address there is no need for nginx to provide the certificate itself, it only needs to pass through the connection to Apache.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.