Lets say that I have an nginx reverse proxy that proxies the traffic to a Tomcat on the same server. I think the most common way to configure this setup is to enable SSL on nginx and then proxy the unencrypted traffic to Tomcat. So far so good. The traffic starts to grow and I decide to move the tomcat to a different server for performance related reasons. Now the connection between the nginx and the Tomcat is unsecure (http).

How should I prepare for this security concern? Should I tunnel the traffic through an SSH tunnel from nginx server to the Tomcat? My servers could be located in a cloud service so the connection between them is not secure (to my knowledge).

1 Answer 1


What you want is "Upstream SSL".

This is when you re-encrypt the backend connection with Nginx. You don't need to buy another certificate. You can use self-signed certificates for the backend.

Discussed here: StackOverflow: Nginx load balance with upstream SSL
and here: ServerFault: Configure Nginx as reverse proxy with upstream SSL

Blog here: "SSL Offloading, Encryption and Certificates with NGINX (Archived here.)
They insist on calling this "End-to-End" encryption in their blog. (It maddens me that they do that. If you re-encrypt, then you're no longer end-to-end encrypting.)
(But Citrix is guilty of the same terminology sin with their "NetScaler" loadbalancer. (Archived here.))

  • 1
    So the magic word was upstream! In this age of cloud services it puzzles me that people seem to assume that connections between servers are secure. Is there a way to make a proper end-to-end encryption with this kind of reverse proxy setup?
    – anssias
    Mar 5, 2015 at 9:46
  • If you're in an cloud environment, it's supposed to look transparent to you where the next spun up instance of tomcat is, but they all reside on the same segment. In that sense, you're on a dedicated network. so the idea that you're on a sniffable network is moot. It is supposed to be as secure as running your own data center. For some folks end to end means end point to endpoint, if the requirements for computation has a break anywhere, including re-encryption, then it should no longer be considered end to end. Marketeers might have a different take on this.
    – munchkin
    Mar 5, 2015 at 11:02
  • Can you really trust that the network is private and unsniffable?
    – anssias
    Mar 5, 2015 at 13:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .