<p>You will find people from both camps (terminating TLS as soon as possible vs terminating TLS in the application code) but it's not as <em>serious</em> as for example tabs vs spaces.</p>

<p>The benefit of terminating TLS by reverse proxy is that application developer does not have to implement TLS in the application itself - possibly introducing bugs. Another benefit mentioned by <a href="https://devops.stackexchange.com/a/6922/3164">jdog</a> is the CPU cost; which is negligible these days - unless you are running 100s of micro-services and it all adds up to a large chunk of money.</p>

<p>Personally I always go with reverse proxy terminating the TLS unless there is a specific requirement against it (security reasons). I also make sure that service behind reverse proxy listens on the localhost / local network only - is not accessible directly form the internet.</p>

<p>You may find <a href="https://en.wikipedia.org/wiki/TLS_termination_proxy" rel="nofollow noreferrer">wikipedia article about TLS termination</a> useful.</p>

CC BY-SA 4.0
2019-04-22T10:37:25.153Z
2019-04-23T16:41:55.337Z
2019-04-23T16:41:55.337Z
Kyslik
<p>There is no direct technical benefit. Some people argue that it takes some cpu load of the Web server. However there are equally articles that claim its only a very small percentage of cpu required to handle TLS.</p>

<p>One major benefit is that a http only caching server (for example Varnish) can be put between http server and tls termination without changing either Web server or public IP address. I have chosen this for my own Web hosting setup, as it is not always feasible to change DNS records en masse. </p>

CC BY-SA 4.0
2019-04-22T02:01:31.233Z
2019-04-22T02:01:31.233Z
jdog
<p>Is there any difference if you use TLS in your application for example in node or java(spring), and if you use normal HTTP in your application and then set up Nginx as a reverse proxy and configure your TLS certificate throw Nginx? 
What would be the benefits of using one instead of another?</p>

CC BY-SA 4.0
2019-04-22T10:12:41.243Z
This is sound question although maybe mis-placed but why -1?
Kyslik
<nginx>
Using HTTPs in application vs reverse proxy
Danilo Gacevic
# Using HTTPs in application vs reverse proxy

(Asked by: username_0 on 2019-04-21)

Is there any difference if you use TLS in your application for example in node or java(spring), and if you use normal HTTP in your application and then set up Nginx as a reverse proxy and configure your TLS certificate throw Nginx?
What would be the benefits of using one instead of another?

**Tags:** nginx

> **Comments:**
> **username_1**: This is sound question although maybe mis-placed but why -1?  

---

## 2 answers

### Answer by username_1 on 2019-04-22. Score: 2

You will find people from both camps (terminating TLS as soon as possible vs terminating TLS in the application code) but it's not as *serious* as for example tabs vs spaces.

The benefit of terminating TLS by reverse proxy is that application developer does not have to implement TLS in the application itself - possibly introducing bugs. Another benefit mentioned by [username_2](https://devops.stackexchange.com/a/6922/3164) is the CPU cost; which is negligible these days - unless you are running 100s of micro-services and it all adds up to a large chunk of money.

Personally I always go with reverse proxy terminating the TLS unless there is a specific requirement against it (security reasons). I also make sure that service behind reverse proxy listens on the localhost / local network only - is not accessible directly form the internet.

You may find [wikipedia article about TLS termination](https://en.wikipedia.org/wiki/TLS_termination_proxy) useful.


---

### Answer by username_2 on 2019-04-22. Score: 0

There is no direct technical benefit. Some people argue that it takes some cpu load of the Web server. However there are equally articles that claim its only a very small percentage of cpu required to handle TLS.

One major benefit is that a http only caching server (for example Varnish) can be put between http server and tls termination without changing either Web server or public IP address. I have chosen this for my own Web hosting setup, as it is not always feasible to change DNS records en masse.


---

