Nginx Reverse Proxy : using self signed SSL certificate to backend server

Question

I need to accomplish this:

User (https using wildcard CA cert 1 year) to --> Nginx reverse proxy (https using self signed cert 10 years) to --> backend server

I'm stuck on configuring the connection from Nginx to the backend server. How to add self signed cert entry in Nginx conf? The purpose of this for easier management, just renew the CA certificate only every year.

server {
    listen 80;
    server_name test.example.com www.test.example.com;
    return 301 https://$host$request_uri;
    add_header Content-Security-Policy upgrade-insecure-requests;
}

server {
    listen 443 ssl;
    server_name test.example.com www.test.example.com;
    ssl_certificate /etc/pki/tls/certs/CA_cert.pem;
    ssl_certificate_key /etc/pki/tls/private/cert_key.key;
    add_header Content-Security-Policy upgrade-insecure-requests;
    
    
    location / {
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_pass https://10.0.0.35;
        }

     location ~ ^/$ {
            return 301 https://test.example.com;
        }
}

Thanks in advance.

Answer 1

Based on my experience you can try the below configuration

server {
    server_name test.example.com www.test.example.com;

    location / {
        proxy_pass https://10.0.0.35; # you can change to http or https based on your need
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr; # you can remove this for testing purposes to make sure it doesnt cause any issues
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; # you can remove this for testing purposes to make sure it doesnt cause any issues
        proxy_set_header X-Forwarded-For $remote_addr; # you can remove this for testing purposes to make sure it doesnt cause any issues
      }

        listen [::]:443 ssl ipv6only=on;
        listen 443 ssl;
        server_name test.example.com www.test.example.com;
        ssl_certificate /etc/pki/tls/certs/CA_cert.pem; # this would usually be fullchain.pem
        ssl_certificate_key /etc/pki/tls/private/cert_key.key; # this would usually be privkey.pem
        add_header Content-Security-Policy upgrade-insecure-requests; # you can remove this for testing purposes to make sure it doesnt cause any issues
    }
    
    server {
        if ($host = test.example.com www.test.example.com) {
            return 301 https://$host$request_uri;
        }
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name test.example.com www.test.example.com;
      return 404; 
}