title: Nginx SSL Proxy to upstream server using SSL
body: <p>I am using nginx as a proxy to kestrel web server both nginx and kestrel are configured for mutual TLS whereby a client can only communicate with the server unless a certificate is sent with the request. I would like to be able to forward the ssl certificates received by nguni to kestrel but seem to be unable to do so. The <code>proxy_ssl on</code> directive errors when used in the server block and also the <code>proxy_ssl_certificate serv.crt</code> directive isn't what I need because this sends a specified certificate to kestrel whereas I would like to send the client certificate which was passed to nginx all the way to kestrel.</p>
  
  <p>Here is a snippet of my Nginx config.</p>
  
  <pre><code>upstream prod {
        server 127.0.0.1:443;
      }
  
      server {
        listen 4430 ssl http2;
        ssl on;
        ssl_certificate /etc/ssl/certs/serv.crt;
        ssl_certificate_key  /etc/ssl/certs/serv.key;
        ssl_password_file    /etc/nginx/certs/ssl_passwords.txt;
        ssl_client_certificate /etc/ssl/ca/certs/ca.crt;
        ssl_crl /etc/ssl/ca/private/ca.crl;
        ssl_verify_client optional_no_ca;
        ssl_session_timeout 5m;
        ssl_prefer_server_ciphers on;
        ssl_protocols TLSv1.2;
        ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDH$
        keepalive_timeout 10;
        server_name my-api;
        try_files $uri @prod;
  
  
  
        location / {
          add_header Access-Control-Allow-Origin *;
          #proxy_ssl_session_reuse on;
          proxy_ssl_trusted_certificate /etc/ssl/certs/serv.crt;
          #proxy_ssl_certificate /etc/ssl/certs/serv.crt;
          #proxy_ssl_certificate_key /etc/ssl/certs/serv.key;
          proxy_ssl_password_file    /etc/nginx/certs/ssl_passwords.txt;
          proxy_ssl_verify       off;
          proxy_ssl_verify_depth 2;
  
  
          proxy_set_header Connection $connection_upgrade;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header X-Forwarded-Proto https;
          proxy_set_header Host $http_host;
          proxy_set_header X-Real-IP $remote_addr;
          proxy_redirect off;
          proxy_pass https://prod;
          access_log /var/log/nginx/access.log;
          error_log /var/log/nginx/error.log;
        }
  </code></pre>
  
  <p>Any assistance would be greatly appreciated.</p>
  
  <p>Thanks</p>