I'm using nginx here as an example, but this is really more of a conceptual question about SSL termination and TCP that could apply to any web server.

Basically, if web server A receives TCP traffic on port 443 (the first nginx config) and then forwards that to web server B on port 1000 running HTTPS (the second nginx config), do I need to even have SSL configured for web server A?

As far as I understand, the answer is no, because web server A is ultimately just forwarding the encrypted traffic it gets on 443 "as is" to port 1000 to be decrypted by web server B. Basically:

client -> encrypted traffic -> web server A -> Pass through (encrypted) -> web server B -> decrypted traffic

However, on the first connection, does it matter than the traffic is temporarily unencrypted, as it routes through web server A before the SSL handshake is established. I've never had a setup where the client establishes an SSL connection to web server B via TCP over web server A, which is not encrypted, so I'm not sure if that is secure. I think it's still fine, as the SSL handshake itself occurs over an unencrypted TCP connection, but not quite sure.

events {}
stream {
    server {
        listen 443;
        listen [::]:443;
events {}
http {
    server {
        listen 1000 ssl http2;
        listen [::]:1000 ssl http2;

        ssl_certificate /etc/ssl/foo.crt;
        ssl_certificate_key /etc/ssl/foo.pem;
        # App

        location / {
            proxy_pass http://localhost:3000;
  • I believe the reverse proxy installs the site's cert (the DNS record points to it).... for server-a to server b you use whatever cert you like but not the site cert as it wouldn't be valid for that domain.
    – pcalkins
    Jun 13 at 21:34
  • 1
    All of your assumptions are correct. Web server A is simply routing TCP packets to web server B, In that regard, server a is simply acting as a router. You could do the same thing, for that matter, using iptables instead of nginx on server a. Therefore, there is no need to setup SSL on web server A. WRT on the first connection, does it matter than the traffic is temporarily unencrypted - no. The initial (unencrypted) handshake passing through server a is no different than the initial unencrypted handshake passing through numerous routers when you connect directly to any HTTPS site.
    – mti2935
    Jun 14 at 1:00
  • @mti2935 that makes sense to me, thanks so much for the confirmation and explanation! Jun 14 at 4:09
  • @mti2935 You should post your comment as an answer.
    – Marcel
    Jun 14 at 5:12
  • Thanks @Marcel. But, I would basically just be re-posting what I've already written, so I'll just leave it as is.
    – mti2935
    Jun 14 at 10:14


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.