What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Configure a proxy certificate by deciding where TLS ends, installing a certificate whose SANs match every public hostname, protecting its private key, and sending the leaf certificate followed by intermediate certificates. If the proxy opens HTTPS connections to an upstream, configure CA validation on that second connection; add a client certificate and key when the upstream requires mTLS. Finally, automate renewal and reload the proxy only after its configuration passes validation.
1. Choose the TLS topology first
A certificate is meaningful only on a specific TLS leg. Draw the client-to-proxy and proxy-to-upstream connections before editing configuration.
Terminate TLS at the edge
The client performs TLS with the proxy. The proxy decrypts the request and sends plain HTTP to the backend. Install the public certificate and private key on the proxy, and make sure the backend network is otherwise protected.
Pass TLS through
The proxy forwards encrypted traffic without seeing HTTP. The TLS certificate and private key remain on the application server. This preserves end-to-end encryption but prevents HTTP-layer routing, header rewriting, cookie handling, and content inspection at the proxy.
#1 Best Overall
Terminate and re-encrypt
The proxy presents a certificate to the client, then starts a separate TLS session to the upstream. This is the usual choice when you need edge routing and encrypted internal traffic. The second session has its own trust rules and, optionally, its own client certificate for upstream mTLS.
Mutual TLS at a forward proxy
For an HTTP CONNECT forward proxy, configure a server certificate so clients can authenticate the proxy, a trusted client CA, and a policy that requires and verifies client certificates. NGINX documents mTLS as authentication in both directions; for its HTTP CONNECT proxy, mTLS is the supported authentication method.
2. Prepare and inspect certificate material
Match names with SANs
Every hostname clients use must appear in the certificate’s Subject Alternative Name (SAN). Include names such as proxy.example.com and any deliberate aliases. A common name alone is not a reliable substitute for SAN validation.
Build the chain in the right order
The file sent by the proxy should contain the leaf (server) certificate first, followed by each intermediate certificate needed by clients. Do not put the root certificate in the served chain unless your proxy documentation specifically requires it. An incomplete chain often works for clients that already cache the intermediate and fails for others.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsKeep the private key private
Store the key outside publicly served directories, restrict its ownership and mode to the proxy’s master process or service account, and avoid placing it in source control or broad backup locations. The certificate is public and is sent to every connecting client; the key is the credential that must remain restricted.
Check that the key and certificate match
Before deployment, compare the public-key fingerprints derived from the certificate and key. For RSA, one practical check is:
openssl x509 -in proxy.example.com.crt -noout -modulus | openssl sha256
openssl rsa -in proxy.example.com.key -noout -modulus | openssl sha256The digests must be identical. For an encrypted or non-RSA key, use the key type’s corresponding OpenSSL public-key extraction commands instead of assuming the modulus command applies.
3. Configure NGINX as a reverse-proxy TLS terminator
Point ssl_certificate at the chained certificate and ssl_certificate_key at the matching key. The listener below allows TLS 1.2 and TLS 1.3:
server {
listen 443 ssl;
server_name proxy.example.com;
ssl_certificate /etc/ssl/certs/proxy.example.com.chained.crt;
ssl_certificate_key /etc/ssl/private/proxy.example.com.key;
ssl_protocols TLSv1.2 TLSv1.3;
location / {
proxy_pass http://backend.example.com;
}
}The NGINX master process must be able to read the key while ordinary users cannot. Place the leaf before intermediates in proxy.example.com.chained.crt. Test the configuration and reload rather than restarting a healthy worker pool:
sudo nginx -t
sudo systemctl reload nginxUse SNI for several hostnames
When several names share one address, configure a server block and certificate for each name. Clients send Server Name Indication (SNI) during the handshake; NGINX uses it to select the matching certificate. A default server still handles clients that omit SNI, so choose that default deliberately and do not assume it proves every hostname is configured.
4. Configure NGINX for HTTPS upstreams and upstream mTLS
When NGINX connects to an HTTPS backend, certificate validation is a separate concern from the client-facing certificate. Configure a CA bundle, enable verification, and set a verification depth appropriate to the chain. If the backend requests client authentication, provide NGINX’s client certificate and key:
location / {
proxy_pass https://backend.example.com;
proxy_ssl_trusted_certificate /etc/ssl/certs/ca-bundle.pem;
proxy_ssl_verify on;
proxy_ssl_verify_depth 2;
proxy_ssl_certificate /etc/ssl/certs/proxy-client.crt;
proxy_ssl_certificate_key /etc/ssl/private/proxy-client.key;
}The trusted CA file validates the upstream’s certificate. The client certificate authenticates NGINX to an upstream that requires mTLS. Ensure the upstream hostname used for verification and SNI is the name covered by its certificate; do not disable verification merely to get a handshake to succeed.
5. Configure an NGINX forward proxy with mTLS
For a TLS-enabled HTTP CONNECT listener, configure the proxy’s server certificate and key, the CA that issued client certificates, and a client-verification policy:
server {
listen 10.10.1.11:3128 ssl;
ssl_certificate /etc/ssl/certs/forward_proxy_server.crt;
ssl_certificate_key /etc/ssl/private/forward_proxy_server.key;
ssl_client_certificate /etc/ssl/certs/forward_proxy_client_ca.crt;
ssl_verify_client on;
ssl_verify_depth 1;
ssl_protocols TLSv1.2 TLSv1.3;
}Distribute client certificates only to authorized callers, rotate them independently from the server certificate, and monitor rejected handshakes. A client that lacks a certificate, chains to another CA, or exceeds the configured verification depth will be refused.
6. Configure HAProxy certificates and SNI
HAProxy commonly uses a PEM bundle containing the certificate and private key. Set base directories and bind the frontend with TLS:
global
crt-base /etc/haproxy/ssl/certs/
key-base /etc/haproxy/ssl/private/
frontend example
bind :443 ssl crt /etc/haproxy/ssl/certs/example.pem
default_backend webserversThe crt PEM normally contains both the certificate and private key. For multiple domains, supply a certificate directory (or the certificate-store form supported by your pinned HAProxy release). HAProxy uses SNI to choose a certificate whose CN or SAN matches the requested domain. Keep key permissions tight even when the PEM combines public and private material.
Recommended Free Tools
Validate the configuration with the HAProxy version installed on the host before reloading. A successful parse does not prove that every chain is complete, so perform an external handshake test for each SNI name.
7. Configure Envoy termination and TLS origination
Envoy separates downstream termination from upstream TLS origination. A downstream TLS context references a certificate chain and private key. An upstream validation context supplies trusted CAs and can enforce subject-name checks, hash pinning, CRLs, and ALPN. Envoy also supports client certificates when an upstream requires mTLS.
Use the secret-loading method appropriate to your deployment: static file references for a simple installation, or a secret-distribution mechanism such as SDS when certificates are managed centrally. Keep the validation context explicit: trusted CA material, expected subject name where applicable, and revocation or pinning rules should be treated as separate controls rather than assumed defaults. Pin the Envoy version and verify field names against its release documentation before rollout because configuration schemas and defaults vary.
8. Automate issuance, renewal, and reload
Certbot can obtain certificates with certbot or certbot certonly, and active files are placed under /etc/letsencrypt/live/. Its renew action checks installed certificates for impending expiry and attempts renewal.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Issue or import the certificate. Select an authentication method that can be repeated without an operator.
- Point the proxy at stable paths. Use the files under
/etc/letsencrypt/live/(or your certificate manager’s stable paths), not timestamped archive files. - Install a deploy or post-renewal hook. The hook should run the proxy’s configuration test first and reload only if validation succeeds.
- Test unattended authentication. Manual authentication requires an authentication hook for automated renewal; otherwise renewal will pause for human input.
- Exercise staging first. Perform a renewal simulation in a non-production environment, verify the complete chain, then run the controlled reload in production.
A typical NGINX hook is conceptually:
#!/bin/sh
set -eu
nginx -t
systemctl reload nginxUse the equivalent validation and graceful reload commands for HAProxy or Envoy. Alert before expiry and after a failed hook; a renewed file that the running process never loaded is still an outage waiting to happen.
Rank #4
9. Verify both TLS legs
- Inspect the certificate and confirm every public proxy hostname appears in SAN.
- Confirm the private key matches and is readable only by the proxy account.
- Check that the served chain starts with the leaf and includes required intermediates.
- Test each client-to-proxy SNI name with an external TLS client.
- Test proxy-to-upstream handshakes, including hostname verification and any required client certificate.
- Confirm the configured trust store contains the issuing CA.
- After renewal, verify the new expiry and certificate serial from a fresh connection, not only from files on disk.
openssl s_client -connect proxy.example.com:443 -servername proxy.example.com -showcerts
curl -v https://proxy.example.com/For an mTLS endpoint, add the client certificate and key to the test command and confirm that a request without them fails when policy requires a certificate.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.10. Troubleshooting common failures
“Certificate does not match hostname”
Cause: the requested name is absent from SAN, or SNI selected a different virtual host. Fix: issue a certificate covering the exact name, configure the matching server block, and retest with -servername.
Browsers report an incomplete chain
Cause: only the leaf was sent, or intermediates are in the wrong order. Fix: concatenate leaf first, then intermediates, and reload the proxy. Do not rely on clients having cached intermediates.
“Permission denied” loading the key
Cause: the service account cannot read the key, or permissions are too restrictive for the master process. Fix: set ownership and mode for the proxy’s documented process model, then restart or reload under the service manager to confirm access.
Upstream handshake fails while client TLS works
Cause: the upstream CA is absent, hostname verification is wrong, SNI is missing, or upstream mTLS credentials are invalid. Fix: inspect the upstream chain, configure the correct trusted CA and server name, and install the requested client certificate and key.
Only one domain works on a shared address
Cause: no SNI-aware certificate selection, a wrong default certificate, or a client that omits SNI. Fix: configure one certificate mapping per hostname and test each name independently.
Renewal succeeds but the old certificate is still served
Cause: files were renewed without a successful reload. Fix: make the deploy hook run configuration validation and a graceful reload, then verify the served serial and expiry from a new connection.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Best Value
- Used Book in Good Condition
mTLS clients are rejected unexpectedly
Cause: the client certificate chains to an untrusted CA, exceeds verification depth, is expired, or was not sent. Fix: inspect the client chain, update the client-CA bundle and depth policy, and test with a known-good client certificate.
11. Reliability, performance, and operating choices
Certificate selection and handshake work occur before HTTP routing, so an invalid chain or failed mTLS policy prevents the request from reaching your application. Keep certificate files local and readable, avoid reloading every request, and use graceful reloads so existing connections can drain. Session reuse and HTTP connection pooling reduce repeated handshakes, while TLS 1.2 and 1.3 provide a clear compatibility boundary for clients.
For high-change certificate environments, central secret distribution can reduce file-copy races, but it adds control-plane dependencies. File-based deployment is simpler and auditable when hooks are atomic and tested. In either model, monitor expiry, handshake errors, reload status, and upstream verification failures separately; a green edge handshake does not prove the second TLS leg is healthy.
Or skip the browser setup
If your goal is to capture a page through a proxy while testing a TLS deployment, ScreenshotNeo can return the image or PDF with one request. Its clean-shot workflow accepts cookie or consent banners and removes more than 60 known consent platforms, newsletter popups, and chat widgets before capture. Bot checks, blank pages, timeouts, failed loads, and cache hits are not billed, and response headers identify the page verdict and billing status. Its MCP server provides take_screenshot, get_page_info, and capture_pdf tools for Claude, Cursor, and other MCP clients.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchSee the parameter reference in the ScreenshotNeo documentation. cURL:
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpPython:
import requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://stripe.com"}, timeout=90)
open("shot.webp", "wb").write(r.content)Node.js:
const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://stripe.com' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);One thousand screenshots per month are free with no card; paid plans start at $5 for 3,000 shots, and every feature is on every plan. Create a free ScreenshotNeo account.
Frequently Asked Questions
Should the proxy certificate include the root CA?
Normally serve the leaf followed by required intermediate certificates; clients are expected to trust the root locally.
Can one certificate serve several proxy hostnames?
Yes, if every hostname is listed in the certificate SAN and the proxy’s SNI mapping selects that certificate.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →What is the difference between a server certificate and an mTLS client certificate?
The server certificate authenticates the proxy to clients. An mTLS client certificate authenticates the proxy to an upstream, or an individual client to a forward proxy.
How often should I test renewal?
Run a staging renewal exercise before production rollout and verify both the reload and the certificate presented on a fresh connection.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
