Nginx proxy_pass to IP but use HTTPS

Question

I have a legacy server that is secured via SSL certificate for example.com. I want to put another server infront of this one to proxy_pass certain (legacy) traffic. The new server must be exposed on example.com too.

If these were on separate domains (legacy.example.com and example.com), I would simply be able to proxy_pass https://legacy.example.com. However, the legacy app is littered with hardcoded example.com URLs (and it only has a SSL certificate for example.com). Any other URL (the IP for example) will redirect to example.com.

What I want to do, is proxy_pass <legacy IP>, set the host header with proxy_set_header Host example.com. But the issue is, this does not use HTTPS.

I did something a while back with curl, I was able to connect to a server by it's IP, but specify the domain to use for the certificate. Even though there was no A record for example.com mapping to this IP, I was able to trick it into thinking it was being connected by that domain.

curl https://example.com/path --resolve example.com:<IP>

Is there anything like this in Nginx?

Answer 1

I haven't used it myself, but it looks like proxy_ssl_name might be what you are looking for:

For example:

proxy_set_header Host example.com;
proxy_ssl_name        example.com;
proxy_pass            https://1.2.3.4;

See this document for details.