1

My question is about SSL/TLS.

I'm running Ubuntu 18.04 server with: Apache2 serving 3 public domains on 1 public IP.

On the same server I'm running: Nginx and will configure as a reverse proxy to the 3 domains.

I must secure the sites with SSL/TLS.

On two domains I'm running the latest versions of: Nextcloud Rocket.Chat The third domain has static data.

I'm going to use Let's Encrypt - Certbot for SSL/TLS.

The question is, do I need to set SSL/TLS for the Nginx Reverse Proxy only (not hosting a domain), for Apache only (hosting all three domains), or do I need to do run Certbot for both Nginx and Apache?

My thought is that since Nginx isn't hosting a domain, there's no need to use SSL/TLS on it, thus I'd think I should treat SSL/TLS as though Nginx isn't even involved and only apply it to Apache.

All responses are appreciated.

Improve this question

1 Answer 1

Reset to default
2

Nginx is a reverse proxy in your example, which means it terminates the HTTP exchange.

Clients do not know that there is anything after Nginx, for them, Nginx is the webserver and the source of the response.

As such the TLS handshake will also finish at Nginx and hence Nginx needs to have the server certificate and associated key to be able to properly set the TLS handshake with clients, "pretending" to be the real webservers for all the domains you host there.

If Nginx and Apache are on the same box, the Nginx to Apache (reverse proxy) part can be over HTTP. If they are on different boxes, then HTTPS is also preferred there, which means Apache will need to have its own certificate(s) and key(s).

Improve this answer
2
  • To clarify: I do understand what you're saying. I would think then that when I run Certbot I can put all three domains in the same certificate, via the Certbot Nginx module, and it should, if I've configured the reverse proxy correctly, find each domain on that 1 public IP, validate each of them, and create a single cert?
    – Thomas Engel
    Commented Feb 6, 2020 at 18:48
  • You can put multiple hostnames in the same certificate, yes (is that a good idea or not? It depends. I am mostly thinking it is not a good idea, but that is orthogonal to your problem of configuring nginx or Apache). The fact that Nginx is a reverse proxy or not is mostly irrelevant to the certificate issuance. You just need to have it reply correctly to the CA requests. Also remember that you have DNS validation and not only HTTP validation available.
    – Patrick Mevzek
    Commented Feb 6, 2020 at 18:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.