title: Configure NGINX (Engintron) HTTPS to HTTP for Nodejs on specific port
body: <p>I'm really new on webserver matters and trying to find a working configuration now for weeks, so any comment is greatly appreciated!
  I have a CentOS machine running cPanel (EasyApache on ports 8080 and 8443) and Nginx in front on ports 80 and 443. Finaly, I have a Node js app running on port 8002.
  My Node app is integrated with a Joomla website homepage, so I really need it to run in a different port (not sure though if 8002 was the best pick).
  All is working great untill I install SSL Let's Encrypt certificates, I did it using cPanel Let's Encrypt for cPanel.
  I've also read that the standard is to pass already encrypted traffic to Node js and let Ngnix deal with https. So, my Nodejs application is expecting http traffic.
  With my current Ngnix configuration if I access it using https:// Joomla website will work fine, but my application will breake with a xhr poll error.
  I can see from console that it is trying to access socket.io through https, which will not work:
      <code>Request URL:https://xxx.xx.xxx.xx:8002/socket.io/?userid=0&amp;EIO=3&amp;transport=polling&amp;t=M086vNB</code>
  While accessing <a href="https://xxx.xx.xxx.xx:8002" rel="nofollow noreferrer">https://xxx.xx.xxx.xx:8002</a> will give me "Secure Connection Failed".</p>
  
  <p>How to configure Ngnix to correctly use my app in this scenario?</p>
  
  <p>Current configuration added on <strong>default.conf</strong> after block for port 80:</p>
  
  <pre><code>server {
      listen 80 default_server;
      server_name localhost;
      # Initialize important variables
      set $CACHE_BYPASS_FOR_DYNAMIC 0;
      set $CACHE_BYPASS_FOR_STATIC 0;
      set $PROXY_DOMAIN_OR_IP $host;
      set $PROXY_TO_PORT 8080;
      set $SITE_URI "$host$request_uri";
      # Generic query string to request a page bypassing Nginx's caching entirely for both dynamic &amp; static content
      if ($query_string ~* "nocache") {
          set $CACHE_BYPASS_FOR_DYNAMIC 1;
          set $CACHE_BYPASS_FOR_STATIC 1;
      }
      # Proxy requests to "localhost"
      if ($host ~* "localhost") {
          set $PROXY_DOMAIN_OR_IP "127.0.0.1";
      }
      # Proxy cPanel specific subdomains
      if ($host ~* "^webmail\.") {
          set $PROXY_DOMAIN_OR_IP "127.0.0.1";
          set $PROXY_TO_PORT 2095;
      }
      if ($host ~* "^cpanel\.") {
          set $PROXY_DOMAIN_OR_IP "127.0.0.1";
          set $PROXY_TO_PORT 2082;
      }
      if ($host ~* "^whm\.") {
          set $PROXY_DOMAIN_OR_IP "127.0.0.1";
          set $PROXY_TO_PORT 2086;
      }
      if ($host ~* "^webdisk\.") {
          set $PROXY_DOMAIN_OR_IP "127.0.0.1";
          set $PROXY_TO_PORT 2077;
      }
      if ($host ~* "^(cpcalendars|cpcontacts)\.") {
          set $PROXY_DOMAIN_OR_IP "127.0.0.1";
          set $PROXY_TO_PORT 2079;
      }
      # Set custom rules like domain/IP exclusions or redirects here
      include custom_rules;
      location / {
          try_files $uri $uri/ @backend;
      }
      location @backend {
          include proxy_params_common;
          # === MICRO CACHING ===
          # Comment the following line to disable 1 second micro-caching for dynamic HTML content
          include proxy_params_dynamic;
      }
      # Enable browser cache for static content files (TTL is 1 hour)
      location ~* \.(?:json|xml|rss|atom)$ {
          include proxy_params_common;
          include proxy_params_static;
          expires 1h;
      }
      # Enable browser cache for CSS / JS (TTL is 30 days)
      location ~* \.(?:css|js)$ {
          include proxy_params_common;
          include proxy_params_static;
          expires 30d;
      }
      # Enable browser cache for images (TTL is 60 days)
      location ~* \.(?:ico|jpg|jpeg|gif|png|webp)$ {
          include proxy_params_common;
          include proxy_params_static;
          expires 60d;
      }
      # Enable browser cache for archives, documents &amp; media files (TTL is 60 days)
      location ~* \.(?:3gp|7z|avi|bmp|bz2|csv|divx|doc|docx|eot|exe|flac|flv|gz|less|mid|midi|mka|mkv|mov|mp3|mp4|mpeg|mpg|odp|ods|odt|ogg|ogm|ogv|opus|pdf|ppt|pptx|rar|rtf|swf|tar|tbz|tgz|tiff|txz|wav|webm|wma|wmv|xls|xlsx|xz|zip)$ {
          set $CACHE_BYPASS_FOR_STATIC 1;
          include proxy_params_common;
          include proxy_params_static;
          expires 60d;
      }
      # Enable browser cache for fonts &amp; fix @font-face cross-domain restriction (TTL is 60 days)
      location ~* \.(eot|ttf|otf|woff|woff2|svg|svgz)$ {
          include proxy_params_common;
          include proxy_params_static;
          expires 60d;
          add_header Access-Control-Allow-Origin *;
      }
      # Prevent logging of favicon and robot request errors
      location = /favicon.ico {
          include proxy_params_common;
          include proxy_params_static;
          expires 60d;
          log_not_found off;
      }
      location = /robots.txt  {
          include proxy_params_common;
          include proxy_params_static;
          expires 1d;
          log_not_found off;
      }
      location = /nginx_status {
          stub_status;
          access_log off;
          log_not_found off;
          # Uncomment the following 2 lines to make the Nginx status page private.
          # If you do this and you have Munin installed, graphs for Nginx will stop working.
          #allow 127.0.0.1;
          #deny all;
      }
      location = /whm-server-status {
          proxy_pass http://127.0.0.1:8080;
          # Comment the following 2 lines to make the Apache status page   public
          allow 127.0.0.1;
          deny all;
      }
      # Deny access to files like .htaccess or .htpasswd
      location ~ /\.ht {
          deny all;
      }
  }
  
  #------- Custom added code
  
  server {
      listen 443 ssl http2;
      listen [::]:443 ssl http2;
      server_name 127.0.0.1:443;
  
      ssl_certificate /home/project/ssl/certs/example_com_d1d73_8dd49_1519411667_866136c129b5999aa4fbd9773c3ec6c1.crt;
      ssl_certificate_key /home/project/ssl/keys/d1d73_8dd49_56cd172fe5a41ee5b923ad66210daecc.key;
      ssl_session_timeout 1d;
      ssl_session_cache shared:SSL:50m;
      ssl_session_tickets off;
  
      location / {
          proxy_pass http://127.0.0.1:8002;
          proxy_set_header Host $http_host;
          proxy_set_header X-Real-IP $remote_addr;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      }
  
      location /socket.io/ {
          proxy_http_version 1.1;
          proxy_set_header Upgrade $http_upgrade;
          proxy_set_header Connection "upgrade";
          proxy_pass "http://127.0.0.1:8002/socket.io/";
      }
  }
  </code></pre>