How to configure nginx reverse proxy to use SECURE websockets upstream?

Question

I want to use nginx as a reverse proxy for websocket connections.

Consider echo.websocket.org to be my backend websocket service. As a test client I use wscat from https://github.com/websockets/wscat.

What works:

client <-- ws --> backend: wscat --connect ws://echo.websocket.org

client <-- wss -->: wscat --connect wss://echo.websocket.org

client <-- ws --> proxy <-- ws --> backend: wscat --connect ws://localhost with the following nginx configuration:

events {
}

http {
    server {
        listen 80;

        location / {
            proxy_pass http://echo.websocket.org;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection upgrade;
        }
    }
}

client <-- wss --> proxy <-- ws --> backend: wscat -n --connect wss://localhost with the following nginx configuration:

events {
}

http {
    server {
        listen 443 ssl;
        ssl_certificate /pki/cert.pem;
        ssl_certificate_key /pki/key.pem;

        location / {
            proxy_pass http://echo.websocket.org;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection upgrade;
        }
    }
}

What I want and what I need help with is configuring nginx to use secure websockets to connect to the backend. I want this configuration:

client <-- wss --> proxy <-- wss --> backend

I tried changing http://echo.websocket.org to https://echo.websocket.org without success. This leads to a 504 Gateway Timeout.

Answer 1

You need to use proxy_ssl_certificate and proxy_ssl_certificate_key as specified in Nginx Docs