introduction

This article explores the use of a reverse proxy to route traffic, secure connections with SSL/TLS and manage multiple backend services such as Nginx and Traefik (two of the most popular tools for these tasks) including automatic certificate provisioning with Let’s Encrypt.

what is a reverse proxy?

It can be used as a reverse proxy, which sits in front of your web servers forwarding client requests to the appropriate backend service.

• Load balance traffic
• Terminate SSL connections
• Provide a single entry point for multiple services
• Add security and caching layers

nginx: the classic reverse proxy

Nginx is a high-performance web server and reverse proxy, widely used for its speed, flexibility and robust configuration options.

reverse proxy example

To forward traffic from https://example.com to a backend service running on localhost:3000:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

server {
    listen 443 ssl;
    server_name example.com;

    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    location / {
        proxy_pass http://localhost:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

ssl certificate management

• Manual: Place your certificate and key files in the appropriate directory and reference them in your config.
• Automatic (Let’s Encrypt): Use Certbot to automatically obtain and renew certificates:

  1	sudo certbot --nginx -d example.com

Certbot will update your Nginx config and handle renewals, as well as renewing.

traefik: the modern cloud-native proxy

Traefik is a dynamic reverse proxy for microservices and containerized environments, which automatically discovers services and can manage SSL certificates with low configuration.

reverse proxy example (docker compose)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

# docker-compose.yml
services:
  traefik:
    image: traefik:v3.0
    command:
      - "--api.insecure=true"
      - "--providers.docker=true"
      - "--entrypoints.websecure.address=:443"
      - "--certificatesresolvers.letsencrypt.acme.tlschallenge=true"
      - "--certificatesresolvers.letsencrypt.acme.email=your@email.com"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock"
      - "./letsencrypt:/letsencrypt"

  app:
    image: your-app-image
    labels:
      - "traefik.http.routers.app.rule=Host(`example.com`)"
      - "traefik.http.routers.app.entrypoints=websecure"
      - "traefik.http.routers.app.tls.certresolver=letsencrypt"

ssl certificate management

• Automatic (Let’s Encrypt): Traefik can request and renew certificates on the fly. Just configure the certificatesresolvers section as above.
• Manual: You can also provide your own certificates if needed.

nginx vs traefik: which should you use?

• Nginx is great for traditional deployments and when you need fine-grained control.
• Traefik shines in containerized, microservices, and cloud-native environments.

conclusion

Both Nginx and Traefik are powerful reverse proxies for SSL certificates: For example, choose NnginX for classic setups and maximum control; or TraEfyk for modern, automated (and container-friendly) workflows; Either way, you can secure your applications and route traffic with minimal effort.