Is it possible to configure nginx to just handle SSL?
I have a web server written in C++ already, but it uses TCP sockets without SSL. I want to connect it to the web, but I want to use something like nginx to handle the SSL, and also basic security like DDOS protection, smurf attack protection, etc.
My question is, can I set up nginx to handle the secure SSL connection, and forward unencrypted http traffic to my web server (on the same machine)?
I feel like this could be a simpler alternative to setting up my application to interface with nginx via FastCGI.
(Any other suggestions, please feel free to suggest)
Yes, this is possible.
-
Make your own software listen on local loopback alone, e.g. on
localhost:8080
. -
Terminate TLS with NGINX.
server { listen 443 ssl; server_name www.example.com; ssl_certificate www.example.com.crt; ssl_certificate_key www.example.com.key; ssl_protocols TLSv1.2; ssl_ciphers HIGH:!aNULL:!MD5; #... }
-
As a best practice, redirect HTTP to HTTPS and enable HSTS for client-side upgrade to encrypted connection.
server { listen 80; server_name example.com; return 301 https://example.com$request_uri; } server { listen 443 ssl; #... add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; #... }
-
Configure NGINX as reverse proxy, e.g.
location / { proxy_pass http://localhost:8080/; }