NGINX Reverse Proxy: Fixing HTTPS Connection Invalid Backend Certificate
When using NGINX as a reverse proxy, you might encounter a situation where the backend website is responding to NGINX reverse-proxy requests, but the user (using their browser) receives an HTTPS connection error due to an invalid backend certificate.
Understanding NGINX Reverse Proxy
NGINX, an open-source web server and reverse proxy server, is commonly used for load balancing, web acceleration, and SSL/TLS termination. As a reverse proxy, NGINX receives incoming HTTP/HTTPS requests from clients (browsers) and forwards them to backend servers while handling tasks like SSL offloading, caching, and compression.
HTTPS Connection Error and Invalid Backend Certificate
When a user connects to your website using HTTPS, a secure connection is established between their browser and your web server. However, if you use NGINX as a reverse proxy for a backend server, the secure connection is established between the user's browser and NGINX. Then, NGINX communicates with the backend server using HTTP, not HTTPS. In this situation, if the backend server presents an HTTPS certificate during this communication, the user's browser will raise an error, stating an "invalid backend certificate." Furthermore, this error might affect other SSL-related security features like HSTS (HTTP Strict Transport Security).
Solution: Trust the Backend Server's Certificate
To resolve the issue, instruct NGINX to trust the backend server's certificate without validating it. NGINX will then ignore the invalid certificate errors. To achieve this, follow these steps:
- Concatenate the backend server's certificate, intermediate CA certificate, and root CA certificate into a single file on your NGINX server.
- Create a new SSL configuration file in the NGINX server's configuration directory.
- Add the following directives to the new SSL configuration file:
ssl_trusted_certificate /path/to/your/trusted/certificate/chain.crt;
upstream backend {
server backend.example.com:443;
}
server {
listen 443 ssl;
location / {
proxy_pass https://backend;
}
}
Replace "/path/to/your/trusted/certificate/chain.crt" with the absolute path of the concatenated certificate file. Replace "backend.example.com:443" with the hostname and port of your backend server.
HTTPS connection errors and invalid certificate issues may arise when using NGINX as a reverse proxy for a backend server. However, by instructing NGINX to trust the backend server's certificate, you can avoid these errors, ensuring secure communication and user-friendly experiences.
- Reference: Understanding NGINX reverse proxy and SSL/TLS termination: NGINX Load Balancing
- Reference: Concatenating and using SSL certificates for NGINX: How To Create a Self-Signed SSL Certificate for NGINX in Ubuntu 16.04
- Recommended Book: "NGINX Cookbook" by Rami Rosen and Rany Kedem, O'Reilly Media.