Solid walkthrough of nginx as web server, reverse proxy, and SSL terminator in one place. The ops footgun after TLS works is usually the forwarded headers, not the cert path: without Host and X-Forwarded-Proto the app still emits absolute http links and mixed-content warnings that look like a browser bug. I terminate once at nginx, pin proxy_http_version 1.1 with Connection cleared for upstream keepalive, and keep proxy_read_timeout shorter than the client-facing timeout so a hung backend fails closed instead of hanging the edge.

After reload I hit the app listen port on localhost, then through the proxy name, and compare status plus response time. If direct works and the proxy 502s, diff upstream resolution and the trailing-slash on proxy_pass before blaming SSL. Log $upstream_addr and $ssl_protocol together for a week — spikes after renew usually mean the new cert loaded but an old worker still held the previous key briefly.