In a reverse proxy setup — Nginx or another proxy sitting in front of an application server (Node.js, Python, a Java app server) — the certificate and the HTTPS redirect both belong at the proxy layer, not inside the application itself, which simplifies certificate management to one place regardless of what's running behind it.
The typical architecture
The proxy terminates TLS, handles the redirect from port 80 to 443, and forwards decrypted traffic to the application server over an internal connection (often plain HTTP, since that internal hop typically stays within a trusted private network or even the same machine). The application server needs to trust the X-Forwarded-Proto header the proxy sets, rather than checking for HTTPS directly, since from the application's perspective every incoming request looks like plain HTTP.
Why this is the recommended pattern
Centralizing TLS at the proxy means certificate renewal, cipher suite configuration, and HTTPS enforcement only need to be managed in one place, regardless of how many application servers or services sit behind it — a meaningful operational simplification once you're running more than a single backend process.
Why centralizing TLS at the proxy simplifies everything behind it
Handling certificate issuance, renewal, and the HTTPS enforcement redirect at a single proxy layer, rather than separately on every backend application server, means certificate management only needs to happen in one place regardless of how many application servers sit behind it.
What the application server needs to trust instead of checking directly
Since the proxy terminates TLS, the backend application server sees every incoming request as plain HTTP — it needs to trust the proxy's X-Forwarded-Proto header to know the original connection was actually secure, rather than performing any direct HTTPS check of its own, which would always incorrectly read as false.
What logging at the proxy layer can tell you that application logs can't
Proxy-level access logs show the actual, real connection details, including the original protocol, before any application-level interpretation — useful specifically when application logs alone don't clearly explain an unexpected redirect or protocol-related behavior.
What health check configuration needs to account for at the proxy layer
Health checks configured at the proxy layer should target an endpoint that correctly reflects backend application health without being affected by any HTTPS-redirect logic the backend might independently implement, avoiding a false-negative health check failure caused by an unexpected redirect response.
How to add end-to-end encryption to the internal hop if your risk tolerance requires it
For environments requiring genuine end-to-end encryption rather than accepting plain HTTP on the internal proxy-to-application hop, configuring the proxy to re-encrypt traffic to the backend, using either a private CA-issued certificate or a self-signed one specifically trusted by the proxy, closes this remaining internal gap.
Why documenting your proxy architecture helps anyone troubleshooting after you
A simple diagram or written description of where TLS terminates, what internal hops exist, and how forwarded headers are configured turns a future troubleshooting session from a discovery exercise into a quick reference check for whoever, possibly not you, ends up debugging an issue later.
A closing thought on this architecture pattern's broad applicability beyond just HTTPS
The centralized-proxy pattern covered in this guide extends well beyond just HTTPS termination — the same architectural principle, one layer handling a cross-cutting concern for everything behind it, applies to logging, rate limiting, and authentication in many modern infrastructure designs.
What Traefik or Caddy add as alternatives to a manually configured Nginx proxy
Both Traefik and Caddy offer more automated certificate provisioning built directly into the proxy itself, often requiring less manual ACME client configuration than a traditional Nginx-plus-Certbot setup — worth considering as an alternative if reducing manual TLS configuration is a priority for a new proxy deployment.
How this guide's principles apply the same way regardless of your specific proxy software choice
The core architectural principle, terminate TLS once at the proxy, forward plain HTTP internally, trust the forwarded-protocol header at the application layer, applies identically whether you're using Nginx, Traefik, Caddy, or any other reverse proxy software — only the specific configuration syntax differs between them.