Irtsgbr

I am trying to set up an NGINX server as a reverse proxy to make it possible to connect via TLS 1.2 to an old IIS server that is limited to TLS 1.0

Connection on port 80 works fine. But I get 502 Bad Gateway when I try to connect over https. When I look at the NGINX error logs I see this line...

*364 peer closed connection in SSL handshake while SSL handshaking to upstream

Below is the config I have for the reverse proxy. (Note, website url and public IP changed to preserve anonymity)

 server
 listen 80;
 listen [::]:80;
 server_name www.mywebsite.com;

 location /
 proxy_set_header Host "www.mywebsite.com";
 proxy_pass http://192.168.201.235:80/; 
 


server 
 listen 443 ssl http2 default_server;
 listen [::]:443 ssl http2 default_server;

 server_name www.mywebsite.com;

 ssl_certificate "/etc/pki/nginx/mywebsite.crt";
 ssl_certificate_key "/etc/pki/nginx/private/mywebsite.key";

 ssl_session_cache shared:SSL:1m;
 ssl_session_timeout 10m;
 ssl_ciphers HIGH:!aNULL:!MD5;
 ssl_prefer_server_ciphers on;

 location / 
 proxy_set_header Host "www.mywebsite.com";
 proxy_pass https://192.168.201.235:443/;
 

Is there anything I can do to resolve the bad gateway issue while still connecting securely between the proxy and the target server?

I can connect to the IP address directly over HTTPS, and if I put in another SSL enabled website after proxy_pass it also works.

I have tried searching for an answer to this on google but none of the hits are so far similar enough to my situation to be helpful.

The setting proxy_ssl_protocols seems to control the connection between nginx and the upstream server (Windows Server 2003 in your case),

https://docs.nginx.com/nginx/admin-guide/security-controls/securing-http-traffic-upstream/

Its default setting today might block TLS 1.0, so you need to set proxy_ssl_protocols TLSv1; to enable TLS 1.0.