iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
To load-balance HTTPS with NGINX, terminate the client’s TLS connection in an HTTPS server block, then proxy the decrypted request to an upstream group. The public certificate and private key stay on NGINX; the second connection can use ordinary HTTP or HTTPS, depending on whether you need encryption all the way to the application servers.
The configuration below uses open-source NGINX directives, two backend servers, TLS 1.2/1.3, round-robin distribution, and forwarding headers that let the application recover the original host, client address, and HTTPS scheme.
What SSL termination and load balancing do
Without a load balancer, clients connect directly to one application server. With NGINX at the edge, the client connects to NGINX on port 443. NGINX completes the TLS handshake, decrypts the HTTP request, selects a backend from an upstream pool, and opens a separate connection to that server.
F5 NGINX describes load balancing across multiple application instances as “a common technique for optimizing resource utilization, maximizing throughput, reducing latency, and improving fault-tolerance.” The benefit comes from distributing requests among the configured servers; the TLS termination point is a separate security decision.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
The two connection legs
- Client to NGINX: encrypted HTTPS. NGINX presents the certificate for the public hostname and reads the corresponding private key.
- NGINX to upstream: HTTP when you use
proxy_pass http://..., or HTTPS when you useproxy_pass https://....
Terminating TLS at NGINX reduces certificate handling on the application servers. It does not automatically encrypt the internal leg, so choose that leg deliberately based on network boundaries, compliance requirements, and the sensitivity of the traffic.
Decide the design before editing NGINX
Choose the public hostname and certificate
Obtain a certificate for the hostname clients will use, such as app.example.com, from a trusted certificate authority. An internally generated certificate is appropriate only for a controlled environment where clients are configured to trust it. Keep the certificate chain and private key in a directory that the NGINX master process can read, while preventing ordinary users and unrelated services from reading the key.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Confirm that your NGINX build supports TLS
The HTTP SSL module must be present. Some builds require the --with-http_ssl_module build option. Check the build supplied by your operating system or compile NGINX with that module before adding an SSL-enabled listener.
List the backend endpoints
Record the address and port of every application instance that should receive traffic. The examples use 10.0.0.11:8080 and 10.0.0.12:8080; replace them with reachable addresses from the NGINX host.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Choose HTTP or HTTPS for the upstream leg
| Upstream design | NGINX directive | Protection between NGINX and applications | Use when |
|---|---|---|---|
| Client-only termination | proxy_pass http://app_backend; |
Plain HTTP after NGINX decrypts the request | The internal network is an acceptable trust boundary and end-to-end encryption is not required |
| Re-encryption | proxy_pass https://app_backend_tls; |
HTTPS on the second leg, with certificate trust configured | Traffic must remain encrypted between NGINX and the backend servers |
Build the basic HTTPS load balancer
1. Put the backend pool in an upstream block
The upstream name is an internal label. NGINX uses the servers listed inside it as the pool targeted by proxy_pass. With no alternative method configured, NGINX uses round robin: successive requests are distributed across the available entries in turn.
http {
upstream app_backend {
server 10.0.0.11:8080;
server 10.0.0.12:8080;
}
# server blocks go here
}Keep the upstream declaration inside the main http context. Do not put it inside a server or location block.
2. Add the client-facing TLS server
The following server listens on 443, presents the public certificate, and forwards requests to the pool over HTTP.
server {
listen 443 ssl;
server_name app.example.com;
ssl_certificate /etc/nginx/tls/app.example.com/fullchain.pem;
ssl_certificate_key /etc/nginx/tls/app.example.com/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_pass http://app_backend;
}
}The listen ... ssl parameter enables TLS on this listener. ssl_certificate points to the certificate chain sent to clients, while ssl_certificate_key points to the matching private key. The four proxy headers preserve request context that would otherwise be lost when the application sees a connection from NGINX rather than directly from the client.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
3. Check the key and certificate relationship
- Ensure the certificate covers the exact public hostname in
server_name. - Ensure
fullchain.pemcontains the server certificate and the required issuing chain. - Ensure the private key matches that certificate.
- Restrict key access to the NGINX master process and authorized administrators. A certificate may be distributed publicly; the private key must not be.
4. Test before reloading
- Run
nginx -tand stop if it reports a syntax, certificate, or permission error. - Correct the reported file, directive, or ownership problem and run the test again.
- Reload NGINX only after the configuration test succeeds, using the reload mechanism provided by your service manager or NGINX installation.
- From a client outside the NGINX host, perform a TLS handshake against the public hostname and verify that the presented certificate is the intended one.
- Send several requests through the public hostname and inspect the application logs on both backends to confirm that traffic is reaching the pool.
Re-encrypt traffic to the upstream servers
Change the second leg to HTTPS when the network between NGINX and the applications must remain encrypted. Use a separate pool if the backend ports or names differ.
http {
upstream app_backend_tls {
server app01.internal.example:8443;
server app02.internal.example:8443;
}
server {
listen 443 ssl;
server_name app.example.com;
ssl_certificate /etc/nginx/tls/app.example.com/fullchain.pem;
ssl_certificate_key /etc/nginx/tls/app.example.com/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_ssl_trusted_certificate /etc/nginx/tls/internal-ca-chain.pem;
proxy_pass https://app_backend_tls;
}
}
}proxy_ssl_trusted_certificate supplies the CA certificates NGINX uses to validate backend certificates. This is the appropriate way to trust a private CA or an internally issued certificate; disabling verification removes an important protection and should not be used as a routine fix.
Backend names and certificate identity
Make the backend certificate names agree with the trust model you have chosen. If certificates are issued to internal DNS names, use those names in the upstream definition rather than unrelated addresses. Resolve any name, chain, or hostname mismatch before treating a failed upstream handshake as a load-balancing problem.
Mutual TLS to the applications
If the backend requires NGINX to authenticate with a client certificate, add the client certificate and key:
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
proxy_ssl_certificate /etc/nginx/tls/nginx-client.pem;
proxy_ssl_certificate_key /etc/nginx/tls/nginx-client-key.pem;Protect this key with the same care as the public-facing private key. The backend must also trust the issuing CA and be configured to request or require the client certificate.
Select a balancing method
| Method or feature | What it does | When it fits | Availability noted in the documentation |
|---|---|---|---|
| Round robin | Distributes requests across the listed upstream servers in sequence | Good starting point when requests have broadly similar cost and duration | Normal baseline for the HTTP load-balancing configuration |
| Least connections | Sends a new request toward the server with fewer active connections | Useful when requests have uneven duration or some clients hold connections longer | Documented NGINX balancing option |
| Least time | Uses response-time information when selecting a server | Workloads where latency differences between instances matter | NGINX Plus capability |
| Slow start | Gradually introduces a server into service | Applications that need warm-up time after joining the pool | NGINX Plus capability |
| Session persistence | Keeps a client’s requests associated with a selected instance | Applications that still require affinity rather than shared session storage | NGINX Plus capability |
Start with round robin unless the workload gives you a reason to change it. Least connections addresses duration imbalance, but it does not make an application stateless or repair a backend that is failing. The advanced features listed above are documented for NGINX Plus and should be evaluated against the edition you operate.
TLS settings and key-management security
Protocol selection
NGINX 1.23.4 and later document TLS 1.2 and TLS 1.3 as defaults. The example sets ssl_protocols TLSv1.2 TLSv1.3; explicitly so the intended policy is visible in the configuration. Older NGINX versions should have their protocol list reviewed rather than relying on a newer version’s defaults.
Private-key permissions
The NGINX master process must be able to read the key at startup or reload, but application users, log readers, and unrelated services should not. Apply ownership and permissions appropriate to your operating system, test a reload after any change, and avoid placing private keys in a directory writable by the application account.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Separate public and internal trust
The CA chain used for client-facing certificates does not have to be the same as the CA chain used for backend certificates. Keep those trust decisions separate. For private backend CAs, install the intended CA bundle and reference it with proxy_ssl_trusted_certificate; do not replace a trust error with blanket verification bypasses.
Run more than one HTTPS site on the same NGINX instance
For multiple hostnames, create a client-facing server block for each site, give each block the correct server_name, certificate, key, and upstream target, and rely on TLS SNI to select the hostname’s certificate during the client handshake. Keep each site’s certificate and private key paths unambiguous. A shared upstream is possible when applications are intentionally identical, but separate pools make ownership and troubleshooting clearer when the sites have different backends.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Validate the complete path
Configuration and process checks
- Syntax:
nginx -tmust succeed before every reload. - Certificate files: the configured paths exist, the key is readable by the master process, and the key matches the certificate.
- Listener: NGINX is listening on 443 for the intended address and the public DNS name reaches that listener.
- Upstream reachability: the NGINX host can connect to every configured backend address and port through the network controls in place.
- Distribution: requests sent through the public hostname appear in logs on the expected backend instances.
External TLS check
Inspect the handshake from a client that uses the real public hostname, not only an IP address. Confirm the certificate subject or SAN, the certificate chain, and the negotiated protocol. A successful handshake proves the client-facing leg works; it does not prove that the selected application server accepted the proxied request.
Quick Recap
Troubleshoot common failures
| Symptom | Likely area | Checks and corrective action |
|---|---|---|
| NGINX will not reload | Syntax, file path, or key permissions | Run nginx -t, read the exact error, then correct the directive or grant the master process read access to the certificate and key. |
| Client sees the wrong certificate | Hostname, SNI, or server-block selection | Verify the requested hostname, its server_name, and the certificate paths in the matching HTTPS server block. |
| TLS handshake fails before a request reaches an application | Protocol policy or certificate chain | Check the configured ssl_protocols, certificate chain, key match, and client compatibility. |
| Requests return an upstream error | Backend connectivity or protocol mismatch | Confirm the backend address and port, then verify that proxy_pass http://... is used for an HTTP service and proxy_pass https://... for an HTTPS service. |
| HTTPS upstream verification fails | Trust bundle or backend identity | Check proxy_ssl_trusted_certificate, the issuing CA, certificate validity, and whether the backend name matches the certificate’s intended identity. |
| Application records NGINX as the client | Missing forwarding headers | Keep Host, X-Real-IP, X-Forwarded-For, and X-Forwarded-Proto in the location that proxies the request. |
| One instance appears to receive disproportionately long-lived work | Balancing method versus request duration | Consider least connections when request lengths differ substantially; confirm the choice with application-level observations rather than changing algorithms blindly. |
Compare the main deployment choices
| Decision | Option A | Option B | Practical consequence |
|---|---|---|---|
| Internal encryption | HTTP from NGINX to applications | HTTPS from NGINX to applications | Option B adds encryption and certificate-trust work on the second leg. |
| Request selection | Round robin | Least connections | Option A is the baseline; Option B is better suited to uneven connection duration. |
| Feature set | Open-source NGINX directives | NGINX Plus features | Least time, slow-start, and session persistence are documented as Plus capabilities. |
| Certificate scope | One site and certificate | Multiple sites with SNI | Option B requires disciplined server names, certificate paths, and key management per hostname. |
Operational checklist
- Install or select an NGINX build with the HTTP SSL module.
- Place the trusted certificate chain and matching private key in protected paths.
- Define every backend in an
upstreamblock. - Create an HTTPS
serverblock with the hostname, certificate, key, and TLS protocol policy. - Set forwarding headers and choose HTTP or HTTPS in
proxy_pass. - If re-encrypting, configure backend CA trust and, when required, a client certificate and key.
- Run
nginx -t, fix every reported error, and then reload. - Test an external handshake and send requests through the public hostname.
- Confirm both TLS legs and backend distribution using NGINX and application logs.
- Revisit the balancing method only when observed request duration, warm-up behavior, or session requirements justify it.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
