Let's say I have a Server A with a valid certificate and a Server B with the key for the certificate.

Client === Nginx Proxy with valid cert === Apache with key

I don't want Ngnix to decrypt all traffic like a MITM. Nginx should pass all encrypted traffic to Apache without leaking the IP-Address of Apache.

If that is possible how do I now set up a "reverse Proxy" with nginx and apache as the upstream server?

I don't want Ngnix to decrypt all traffic like a MITM. Nginx should pass all encrypted traffic to Apache without leaking the IP-Address of Apache.

In this case you don't want to have a (reverse) proxy for HTTP but you just want to pass the data stream without any changes at the TCP level to the real host. nginx can do this with the stream backend.

Note that this does not make nginx serve the certificate and Apache the key. Instead Apache has both the certificate and key and nginx none of these. Since the certificate is not bound to an IP address there is no need for nginx to provide the certificate itself, it only needs to pass through the connection to Apache.

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.