I am trying to configure re-encryption on a backend, so that traffic between nginx and the upstream app is encrypted separately from traffic between the user and nginx. For the purpose of a test example, I am using this: https://github.com/jlengstorf/tutorial-deploy-nodejs-ssl-digitalocean-app.git. I have read many threads, but I always end up getting Error 502: Bad Gateway. Also, I am not sure how paranoid it is to even bother with this. Everything is on one host, but I will be running several services and my reasoning is that any one of them might have exploits and that risk could be mitigated by each app communicating with nginx under a different certificate. To keep the example simple, I just used one key for Everything. Obviously if I were doing this for real I would make a new certificate for each instance of re-encryption. I'm new to web hosting and thinking about security, so please let me know if I said anything cringy above.
mydomain.conf
# HTTP — redirect all traffic to HTTPS
server {
listen 443 ssl;
server_name 127.0.0.1:5000;
ssl_certificate /etc/letsencrypt/live/mydomain.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/mydomain.com/privkey.pem;
root /var/www/html;
index test_index.html;
return 301 https://$host$request_uri;
}
# HTTPS — proxy all requests to the Node app
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name mydomain.com;
root /var/www/html;
index test_index.html;
# Use the Let’s Encrypt certificates
ssl_certificate /etc/letsencrypt/live/mydomain.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/mydomain.com/privkey.pem;
# Include the SSL configuration from cipherli.st
include snippets/ssl-params.conf;
location /app {
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-NginX-Proxy true;
proxy_pass https://localhost:5000/;
proxy_ssl_verify on;
proxy_ssl_trusted_certificate /etc/letsencrypt/live/mydomain.com/fullchain.pem;
proxy_ssl_certificate_key /etc/letsencrypt/live/mydomain.com/privkey.pem;
proxy_ssl_session_reuse off;
proxy_set_header Host $http_host;
proxy_cache_bypass $http_upgrade;
proxy_redirect off;
}
}
The corresponding error from /var/nginx/error.log:
2020/10/22 16:17:13 [error] 11311#11311: *1 SSL_do_handshake() failed
(SSL: error:1408F10B:SSL routines:ssl3_get_record:wrong version number
) while SSL handshaking to upstream, client: xx.xxx.xx.xx, server: the
3guys.com, request: "GET /app HTTP/1.1", upstream: "https://127.0.0.1:
5000/", host: "mydomain.com"
In ssl-params.conf snippet included in the nginx site conf, I set to use all versions of TLS that I am aware of:
ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
