title: NGINX proxy_pass and upstream SSL certificate
body: <p>community!</p>
  <p>I have a reverse proxy based on NGINX.
  The idea is to provide my customers with custom domains for my services.
  For example, the customer will create a CNAME record pointing to my Proxy server:
  video.mycustomer.com --&gt; mynginxserver.com</p>
  <p>Then I generate the SSL certificate (Let'sEncrypt) and create the following Virtual host:</p>
  <pre><code>    server {
          listen 80;
          server_name video.mycustomer.com;
          access_log /var/log/nginx/$server_name-access.log;
          error_log /var/log/nginx/$server_name-error.log;
          return 301 https://$server_name$request_uri; # Redirect to https
          }
  
      server {
          listen 443 ssl http2;
          server_name video.mycustomer.com;
          access_log /var/log/nginx/$server_name-ssl-access.log;
          error_log /var/log/nginx/$server_name-ssl-error.log;
  
          ssl on;
          ssl_certificate /etc/letsencrypt/live/video.mycustomer.com/fullchain.pem;
          ssl_certificate_key /etc/letsencrypt/live/video.mycustomer.com/privkey.pem;
          ssl_session_timeout 5m;
          ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
          ssl_dhparam /etc/ssl/certs/dhparam.pem;
          ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
          ssl_prefer_server_ciphers on;
          ssl_session_cache shared:SSL:10m;
  
          location /.well-known/acme-challenge/ {
              root /web/sites/$server_name/www/;
          }
          location / {
              proxy_pass http://myservice.com/channel/cfa-xw88bbxlsd/; 
              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
              proxy_set_header X-Real-IP $remote_addr;
          }
      }
  </code></pre>
  <p>As long as I'm pointing to an <strong>HTTP</strong> everything works like a charm.
  But when I try to set the proxy_pass to an HTTPS resource (my resource and I owe the certificate), I'm getting <strong>502 Bad Gateway</strong>.</p>
  <p>This is what I get from the error.log file:</p>
  <pre><code>==&gt; video.mycustomer.com-ssl-error.log &lt;==
  2021/10/19 18:56:44 [error] 11316#11316: *1333 SSL_do_handshake() failed (SSL: error:1408F10B:SSL routines:ssl3_get_record:wrong version number) while SSL handshaking to upstream, client: 86.79.99.252, server: video.mycustomer.com, request: &quot;GET / HTTP/2.0&quot;, upstream: &quot;https://98.64.64.90:443/&quot;, host: &quot;video.mycustomer.com&quot;
  2021/10/19 18:56:44 [error] 11316#11316: *1333 SSL_do_handshake() failed (SSL: error:1408F10B:SSL routines:ssl3_get_record:wrong version number) while SSL handshaking to upstream, client: 86.79.99.252, server: video.mycustomer.com, request: &quot;GET / HTTP/2.0&quot;, upstream: &quot;https://98.64.64.79:443/&quot;, host: &quot;video.mycustomer.com&quot;
  2021/10/19 18:56:44 [error] 11316#11316: *1333 SSL_do_handshake() failed (SSL: error:1408F10B:SSL routines:ssl3_get_record:wrong version number) while SSL handshaking to upstream, client: 86.79.99.252, server: video.mycustomer.com, request: &quot;GET / HTTP/2.0&quot;, upstream: &quot;https://98.64.64.24:443/&quot;, host: &quot;video.mycustomer.com&quot;
  2021/10/19 18:56:44 [error] 11316#11316: *1333 SSL_do_handshake() failed (SSL: error:1408F10B:SSL routines:ssl3_get_record:wrong version number) while SSL handshaking to upstream, client: 86.79.99.252, server: video.mycustomer.com, request: &quot;GET / HTTP/2.0&quot;, upstream: &quot;https://98.64.64.4:443/&quot;, host: &quot;video.mycustomer.com&quot;
  2021/10/19 18:56:44 [error] 11316#11316: *1333 connect() to [2600:8000:2153:2000:d:1f52:c300:83b1]:443 failed (101: Network is unreachable) while connecting to upstream, client: 86.79.99.252, server: video.mycustomer.com, request: &quot;GET / HTTP/2.0&quot;, upstream: &quot;https://[2600:8000:2153:2000:d:1f52:c300:83b1]:443/&quot;, host: &quot;video.mycustomer.com&quot;
  2021/10/19 18:56:44 [error] 11316#11316: *1333 connect() to [2600:8000:2153:1200:d:1f52:c300:83b1]:443 failed (101: Network is unreachable) while connecting to upstream, client: 86.79.99.252, server: video.mycustomer.com, request: &quot;GET / HTTP/2.0&quot;, upstream: &quot;https://[2600:8000:2153:1200:d:1f52:c300:83b1]:443/&quot;, host: &quot;video.mycustomer.com&quot;
  2021/10/19 18:56:44 [error] 11316#11316: *1333 connect() to [2600:8000:2153:c200:d:1f52:c300:83b1]:443 failed (101: Network is unreachable) while connecting to upstream, client: 86.79.99.252, server: video.mycustomer.com, request: &quot;GET / HTTP/2.0&quot;, upstream: &quot;https://[2600:8000:2153:c200:d:1f52:c300:83b1]:443/&quot;, host: &quot;video.mycustomer.com&quot;
  2021/10/19 18:56:44 [error] 11316#11316: *1333 connect() to [2600:8000:2153:b200:d:1f52:c300:83b1]:443 failed (101: Network is unreachable) while connecting to upstream, client: 86.79.99.252, server: video.mycustomer.com, request: &quot;GET / HTTP/2.0&quot;, upstream: &quot;https://[2600:8000:2153:b200:d:1f52:c300:83b1]:443/&quot;, host: &quot;video.mycustomer.com&quot;
  2021/10/19 18:56:44 [error] 11316#11316: *1333 connect() to [2600:8000:2153:b000:d:1f52:c300:83b1]:443 failed (101: Network is unreachable) while connecting to upstream, client: 86.79.99.252, server: video.mycustomer.com, request: &quot;GET / HTTP/2.0&quot;, upstream: &quot;https://[2600:8000:2153:b000:d:1f52:c300:83b1]:443/&quot;, host: &quot;video.mycustomer.com&quot;
  2021/10/19 18:56:44 [error] 11316#11316: *1333 connect() to [2600:8000:2153:5200:d:1f52:c300:83b1]:443 failed (101: Network is unreachable) while connecting to upstream, client: 86.79.99.252, server: video.mycustomer.com, request: &quot;GET / HTTP/2.0&quot;, upstream: &quot;https://[2600:8000:2153:5200:d:1f52:c300:83b1]:443/&quot;, host: &quot;video.mycustomer.com&quot;
  2021/10/19 18:56:44 [error] 11316#11316: *1333 connect() to [2600:8000:2153:4a00:d:1f52:c300:83b1]:443 failed (101: Network is unreachable) while connecting to upstream, client: 86.79.99.252, server: video.mycustomer.com, request: &quot;GET / HTTP/2.0&quot;, upstream: &quot;https://[2600:8000:2153:4a00:d:1f52:c300:83b1]:443/&quot;, host: &quot;video.mycustomer.com&quot;
  2021/10/19 18:56:44 [error] 11316#11316: *1333 connect() to [2600:8000:2153:2600:d:1f52:c300:83b1]:443 failed (101: Network is unreachable) while connecting to upstream, client: 86.79.99.252, server: video.mycustomer.com, request: &quot;GET / HTTP/2.0&quot;, upstream: &quot;https://[2600:8000:2153:2600:d:1f52:c300:83b1]:443/&quot;, host: &quot;video.mycustomer.com&quot;
  </code></pre>
  <p>I tried to work with:</p>
  <pre><code>proxy_ssl_certificate     /home/ubuntu/ssl-proxy/pass_cert/client.pem;
  proxy_ssl_certificate_key /home/ubuntu/ssl-proxy/pass_cert/client.key;
  </code></pre>
  <p>With no luck.</p>
  <p>Any ideas?
  Thanks in advance,
  Dan.</p>