Intermediate

Configure Nginx Reverse Proxy with HTTPS

Put Nginx in front of a Spring Boot app, terminate TLS with a free Let's Encrypt certificate, and force HTTPS.

1 hr

Prerequisites

A server with a public IP and a domain pointed at it
Spring Boot app running on an internal port (e.g. 8080)
Nginx and Certbot installed

Architecture

TLS terminates at the proxy, not the app

ClientHTTPS request

Nginx :443TLS termination

Spring Boot :8080plain HTTP, localhost only

Build checklist

Steps

0 of 4 complete

Step 1

Write the base reverse proxy config

nginx

server {
    listen 80;
    server_name api.example.com;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Step 2

Test the config, then reload Nginx

bash

nginx -t && nginx -s reload

Step 3

Provision a free certificate and auto-configure HTTPS

Certbot rewrites the config to listen on 443 with the certificate, and adds an HTTP→HTTPS redirect for the existing server block.

bash

certbot --nginx -d api.example.com

Step 4

Verify auto-renewal actually works

bash

certbot renew --dry-run

Expected result

What success looks like

https://api.example.com reaches the Spring Boot app, http://api.example.com redirects to HTTPS automatically, and the certificate renews itself before it expires.

Lessons learned

Tip

The app itself never needs to know about TLS at all — it just serves plain HTTP on localhost, and Nginx handles encryption entirely at the edge.

Tip

X-Forwarded-Proto is what lets the app correctly detect the original request was HTTPS, even though Nginx talks to it over plain HTTP internally — without it, redirect logic and secure-cookie logic in the app can misbehave.

Tip

Certbot's renewal is a scheduled job (cron or systemd timer) installed automatically — the dry-run is how you confirm it'll actually fire before you find out the hard way at 2am when a cert expires.