How to Configure Nginx Reverse Proxy with Ssl Termination on Ubuntu Server

ByAkensai

How to configure Nginx reverse proxy with SSL termination on Ubuntu Server is essential for modern web applications that need secure, scalable architecture. This configuration allows you to handle SSL encryption at the proxy level while forwarding decrypted traffic to backend servers. You’ll learn to set up Nginx as a reverse proxy, implement SSL termination, and secure your server infrastructure.

SSL termination at the proxy level offers significant advantages. It reduces computational load on backend servers and centralizes certificate management. This setup is particularly useful for load balancing multiple backend services or adding SSL to applications that don’t natively support it.

This tutorial covers installing Nginx, configuring reverse proxy settings, obtaining SSL certificates, and implementing proper security measures. You’ll also learn troubleshooting techniques for common configuration issues. By the end, you’ll have a fully functional reverse proxy with SSL termination protecting your backend services.

Prerequisites and Requirements for Nginx Reverse Proxy with SSL Termination

Before starting this tutorial on how to configure Nginx reverse proxy with SSL termination on Ubuntu Server, ensure you have the following prerequisites in place.

You need an Ubuntu Server 20.04 or newer with root access or sudo privileges. Your server should have at least 1GB of RAM and 10GB of disk space. A stable internet connection is required for downloading packages and obtaining SSL certificates.

You must have a registered domain name pointing to your server’s IP address. This domain is essential for SSL certificate generation. Additionally, ensure your backend application is running and accessible locally on your server.

Basic knowledge of Linux command line, text editors like nano or vim, and understanding of web servers is assumed. Familiarity with DNS configuration and basic networking concepts will be helpful.

The estimated completion time is 45-60 minutes, depending on your experience level. Make sure to have your domain registrar’s control panel access ready for DNS verification if needed.

Finally, ensure your firewall allows HTTP (port 80) and HTTPS (port 443) traffic. You’ll also need the backend service port accessible locally for proxy forwarding.

Step-by-Step Guide to Configure Nginx Reverse Proxy with SSL Termination

Related article: How to Set Up Automated Mysql Database Backups with Cron Jobs

Follow these detailed steps to set up your reverse proxy configuration with SSL termination capabilities.

Step 1: Update your Ubuntu system and install Nginx

Start by updating your package repository and installing Nginx web server:

sudo apt update
sudo apt upgrade -y
sudo apt install nginx -y

Verify the installation by checking Nginx status:

sudo systemctl status nginx
sudo systemctl enable nginx

This ensures Nginx starts automatically on system boot. The service should show as active and running.

Step 2: Install Certbot for SSL certificate management

Install Certbot and the Nginx plugin to obtain free SSL certificates from Let’s Encrypt:

sudo apt install certbot python3-certbot-nginx -y

Certbot will handle SSL certificate generation and automatic renewal. The Nginx plugin integrates seamlessly with your web server configuration.

Step 3: Create the basic Nginx configuration file

Navigate to the Nginx sites-available directory and create a new configuration file:

sudo nano /etc/nginx/sites-available/your-domain.com

Add the following basic configuration, replacing your-domain.com with your actual domain:

server {
    listen 80;
    server_name your-domain.com www.your-domain.com;
    
    location / {
        return 301 https://$server_name$request_uri;
    }
}

This configuration redirects all HTTP traffic to HTTPS, which we’ll configure next.

Step 4: Enable the site and test the configuration

Create a symbolic link to enable your site:

sudo ln -s /etc/nginx/sites-available/your-domain.com /etc/nginx/sites-enabled/

Test the Nginx configuration for syntax errors:

sudo nginx -t

If the test passes, reload Nginx to apply the changes:

sudo systemctl reload nginx

Step 5: Obtain SSL certificates using Certbot

Run Certbot to obtain SSL certificates for your domain. The official Certbot documentation provides additional configuration options:

sudo certbot --nginx -d your-domain.com -d www.your-domain.com

Follow the prompts to enter your email address and agree to the terms of service. Certbot will automatically modify your Nginx configuration to include SSL settings.

Step 6: Configure the reverse proxy with SSL termination

Edit your Nginx configuration file to add the reverse proxy settings:

sudo nano /etc/nginx/sites-available/your-domain.com

Replace the content with this complete configuration:

server {
    listen 80;
    server_name your-domain.com www.your-domain.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name your-domain.com www.your-domain.com;

    ssl_certificate /etc/letsencrypt/live/your-domain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/your-domain.com/privkey.pem;
    
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $server_name;
        proxy_redirect off;
    }
}

Replace http://127.0.0.1:3000 with your backend application’s address and port.

Step 7: Test and reload the configuration

Verify your configuration syntax:

sudo nginx -t

If successful, reload Nginx to apply the reverse proxy settings:

sudo systemctl reload nginx

Step 8: Configure firewall rules

Ensure your firewall allows the necessary traffic. If using UFW:

sudo ufw allow 'Nginx Full'
sudo ufw enable

This allows both HTTP and HTTPS traffic through your firewall.

Troubleshooting Common Nginx Reverse Proxy SSL Configuration Issues

When implementing how to configure Nginx reverse proxy with SSL termination on Ubuntu Server, you might encounter several common issues. Here are solutions for the most frequent problems.

SSL Certificate Issues: If Certbot fails to obtain certificates, verify your domain points to the correct IP address. Check DNS propagation using online tools. Ensure ports 80 and 443 are accessible from the internet. If behind a firewall or CDN, you may need to use DNS validation instead:

sudo certbot certonly --dns-cloudflare -d your-domain.com

502 Bad Gateway Errors: This typically indicates your backend service isn’t running or accessible. Verify your backend application is listening on the specified port:

sudo netstat -tlnp | grep :3000

Check if your backend service is running and restart it if necessary.

SSL Configuration Warnings: Modern browsers require strong SSL configurations. Test your SSL setup using the SSL Labs SSL Test to identify security issues. Update your SSL cipher suites if you receive warnings about weak encryption.

Permission Denied Errors: Nginx might lack permission to read SSL certificates. Ensure proper ownership and permissions:

sudo chown -R root:root /etc/letsencrypt/
sudo chmod -R 755 /etc/letsencrypt/

Connection Timeout Issues: If connections timeout, check your proxy timeout settings. Add these directives to your location block:

proxy_connect_timeout 60s;
proxy_send_timeout 60s;
proxy_read_timeout 60s;

Always check Nginx error logs for specific error messages:

sudo tail -f /var/log/nginx/error.log

Optimizing and Securing Your SSL Reverse Proxy Setup

After successfully implementing your reverse proxy configuration, additional optimization and security measures will enhance performance and protection.

Enable HTTP/2 support for improved performance by ensuring your SSL configuration includes the http2 parameter in the listen directive. This protocol multiplexes requests and reduces latency significantly.

Implement security headers to protect against common web vulnerabilities. Add these headers to your server block:

add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

Configure automatic SSL certificate renewal to prevent expiration issues. Test the renewal process:

sudo certbot renew --dry-run

Set up monitoring for your reverse proxy to track performance and identify issues early. Consider implementing rate limiting to prevent abuse and DDoS attacks.

Similar Posts