Put Nginx in front of Jenkins, terminate TLS at Nginx, and proxy requests to Jenkins over its local HTTP listener. The reliable configuration preserves the public host and HTTPS scheme, forwards client-address headers, supports WebSocket upgrades, disables request buffering for Jenkins HTTP CLI traffic, and keeps the public URL path identical to Jenkins’ context path.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
This arrangement gives browsers an HTTPS endpoint while Jenkins can continue listening on 127.0.0.1:8080. It also prevents users from bypassing the TLS endpoint by connecting directly to Jenkins. The details below cover a root-host deployment such as https://jenkins.example.com/ and a subpath deployment such as https://example.com/jenkins/.
As an Amazon Associate I earn from qualifying purchases.
How the HTTPS reverse-proxy design works
Nginx is the public HTTP server. It listens on TCP port 443, presents the certificate for your Jenkins hostname, decrypts browser traffic, and sends the request to Jenkins’ local HTTP service. Jenkins describes this as an alternate HTTP or HTTPS provider communicating with browsers on Jenkins’ behalf. The internal hop may remain HTTP because it is confined to the local machine or a protected private network; the browser-facing hop is HTTPS.
A typical root-host flow is:
- A browser requests
https://jenkins.example.com/. - Nginx validates the TLS connection and serves the certificate configured for that hostname.
- Nginx forwards the request to Jenkins at
127.0.0.1:8080. - Forwarded headers tell Jenkins that the original request used the public hostname, client address, and HTTPS scheme.
- Jenkins generates redirects, absolute links, cookies, and WebSocket URLs using that public information.
If the public URL is HTTPS but Jenkins is told only that the internal request was HTTP, Jenkins can emit HTTP redirects or links. Browsers may then show mixed-content-looking behavior, send users to the wrong address, or repeatedly redirect. Correct forwarding is therefore part of the security and functionality configuration, not an optional optimization.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Prerequisites and decisions
Choose the public hostname
Create a DNS record such as jenkins.example.com pointing to the Nginx host or load balancer. The certificate must cover the exact hostname users enter. If you use a wildcard or a certificate with multiple names, verify that the Jenkins name is included; the Jenkins guidance does not require any particular certificate authority.
Decide where TLS terminates
This guide assumes Nginx terminates TLS directly. If another load balancer terminates TLS first, that device must preserve the original HTTPS scheme and pass it to Nginx, and Nginx must pass it to Jenkins. Do not allow an untrusted network to set forwarding headers that your proxy uses as authoritative.
Keep Jenkins off the public interface
Jenkins’ official Nginx example uses 127.0.0.1:8080 when the controller and Nginx share a machine. Bind Jenkins to loopback where possible, or restrict its private listener with a firewall so users cannot bypass Nginx. The only intended public entry point should be the TLS virtual host.
Record your current URL and context path
Decide whether Jenkins will live at the hostname root or below a path. A root deployment uses https://jenkins.example.com/ and an empty Jenkins prefix. A subpath deployment uses a matching value such as https://example.com/jenkins/ and Jenkins prefix /jenkins. Changing this decision after plugins and agents are configured creates avoidable migration work.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Build the Nginx HTTPS configuration
Start with the configuration below and change only the server name, certificate paths, and upstream address for your environment. The values shown for certificate files are illustrative paths, not a requirement to use a specific certificate provider.
upstream jenkins {
keepalive 32;
server 127.0.0.1:8080;
}
map $http_upgrade $connection_upgrade {
default upgrade;
'' '';
}
server {
listen 443 ssl;
server_name jenkins.example.com;
ssl_certificate /etc/letsencrypt/live/jenkins.example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/jenkins.example.com/privkey.pem;
location / {
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_pass http://jenkins;
proxy_http_version 1.1;
proxy_request_buffering off;
proxy_connect_timeout 90;
proxy_send_timeout 90;
proxy_read_timeout 90;
}
}Why each directive matters
| Directive | Purpose | What can break if it is missing or changed |
|---|---|---|
upstream jenkins |
Names the backend and keeps up to 32 idle connections available. | Nginx may have no defined destination, or connection reuse may be less predictable under load. |
proxy_set_header Host $http_host |
Preserves the hostname and requested port supplied by the browser. | Jenkins can generate links for an internal name instead of the public name. |
X-Real-IP |
Passes the immediate client address. | Logs and access controls may show only the proxy address. |
X-Forwarded-For |
Maintains the chain of client and proxy addresses. | Jenkins and audit logs lose the originating address information. |
X-Forwarded-Proto $scheme |
Tells Jenkins that the browser used HTTPS on this server block. | HTTP redirects, incorrect absolute URLs, and security warnings can appear. |
Upgrade and Connection |
Preserve WebSocket negotiation. | WebSocket-dependent agents and features fail or fall back unexpectedly. |
proxy_http_version 1.1 |
Uses HTTP/1.1 to the backend, required for the upgrade flow. | WebSocket upgrades can be rejected by the upstream connection. |
proxy_request_buffering off |
Lets Jenkins receive HTTP CLI request data without Nginx buffering the entire request. | CLI streaming or long-running operations can hang, consume excess temporary storage, or terminate early. |
| 90-second timeout directives | Sets explicit connection, send, and read limits for the proxy hop. | Inconsistent defaults can close a valid request before Jenkins finishes. |
Keep proxy_pass http://jenkins; exactly as shown for this layout. Jenkins cautions against appending a slash to the proxy_pass value because Nginx can then rewrite the path and produce broken Jenkins URLs.
Recommended Free Tools
Certificate file permissions
The Nginx worker or master process must be able to read the certificate and private-key files. Give the private key the narrowest ownership and mode your operating system permits, and ensure renewal procedures reload Nginx after replacing the files. A valid certificate that Nginx cannot read is operationally the same as no certificate.
Redirect HTTP requests to HTTPS
Use a separate port-80 server block for the same hostname. Preserve the complete request URI while changing only the scheme and authority:
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
server {
listen 80;
server_name jenkins.example.com;
return 301 https://jenkins.example.com$request_uri;
}Scope this redirect to the Jenkins hostname. If the machine serves unrelated sites, do not create a catch-all redirect that accidentally moves their traffic. When a load balancer performs the redirect instead, apply the same rule there and confirm that the request reaching Nginx still carries the correct original scheme.
Match Jenkins’ URL and context path
Root deployment
For https://jenkins.example.com/, leave Jenkins’ prefix empty and use location /. Jenkins should be configured with the same public URL used by users. Test navigation after login so generated links, form actions, and redirects all remain on the hostname and HTTPS scheme.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Subpath deployment
For https://example.com/jenkins/, configure Jenkins with --prefix=/jenkins. On a Linux package installation, create a systemd override with:
sudo systemctl edit jenkinsAdd:
[Service]
Environment="JENKINS_PREFIX=/jenkins"Then restart Jenkins. The Nginx location and Jenkins prefix must describe the same path, and the proxy must not silently strip or add that segment. A mismatch commonly causes 404 responses, broken folder links, or failures in interfaces that construct URLs dynamically.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
| Deployment | Public URL example | Jenkins prefix | Nginx path rule | Operational trade-off |
|---|---|---|---|---|
| Root host | https://jenkins.example.com/ |
Empty | location / |
Simplest path handling and usually the fewest plugin assumptions. |
| Subpath | https://example.com/jenkins/ |
/jenkins |
Location must retain /jenkins when proxying. |
Shares a hostname with other applications but requires stricter path consistency and testing. |
Apply the configuration safely
- Save the HTTPS and HTTP server blocks in the Nginx site configuration used by your distribution.
- Replace the example hostname, backend address, and certificate paths. Do not copy illustrative paths that do not exist on your server.
- Check syntax before touching live traffic with
sudo nginx -t. Fix every reported error; a successful test should report valid syntax and a successful configuration test. - Reload Nginx without dropping existing connections:
sudo systemctl reload nginx. - Set or verify Jenkins’ public URL and, for a subpath deployment, apply the prefix override.
- Restart Jenkins only when the URL or prefix change requires it, then watch the service log for startup errors.
- Confirm that the Jenkins listener is reachable locally but not exposed through an unintended public interface.
If Nginx fails to reload, restore the last known-good configuration, run the syntax test again, and inspect the Nginx error log. Do not troubleshoot application redirects while the proxy is serving a partially applied configuration.
Validate pages, redirects, WebSockets, and CLI traffic
Test the browser-facing URL
Open the public HTTPS address in a private browser window. Log in, open several pages, and follow links into jobs, folders, configuration screens, and console output. The address bar should remain on the expected HTTPS hostname and path. A redirect that changes only the path, or a redirect to an internal port, indicates that Jenkins is not receiving the original host or scheme correctly.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Inspect headers from outside
From a client that resolves the public DNS name, run:
curl -I https://jenkins.example.com/Use the result to confirm the TLS endpoint responds and that redirects, if any, point to the intended HTTPS URL. A response from Nginx proves only that the front end is reachable; complete the browser and Jenkins checks before declaring the deployment successful.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Exercise a WebSocket-dependent feature
Use a representative inbound or outbound agent and any Jenkins feature in your installation that relies on WebSockets. Confirm the connection establishes and remains active while a job runs. If it fails, verify all four pieces together: the Upgrade header, the Connection value generated by the map, proxy_http_version 1.1, and the absence of an intermediate proxy that removes upgrade headers.
Run an HTTP CLI operation
Run a normal Jenkins HTTP CLI command through the public HTTPS URL, including a command that produces streaming or takes long enough to expose buffering and timeout problems. Confirm that output arrives progressively and that the command does not end with a premature EOF. Keep request buffering disabled for this traffic.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Check Jenkins’ reverse-proxy monitor
Review the administrative warnings and the reverse-proxy setup monitor in Jenkins after logging in. Jenkins actively checks whether its observed request information is consistent with the external URL. Treat a warning as a configuration defect to investigate, not as a message to dismiss: compare the request and response headers, public URL, and context path.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshoot by symptom
| Symptom | Likely cause | Action |
|---|---|---|
| Jenkins says “Your reverse proxy setup is broken.” | Jenkins detects inconsistent host, scheme, port, or rewritten response information. | Verify Host, X-Forwarded-Proto, and, where your topology needs them, X-Forwarded-Host and X-Forwarded-Port. Check that no second proxy overwrites these values. |
| Login returns to HTTP, or links use HTTP. | The public HTTPS scheme was not forwarded. | On the TLS server block, confirm proxy_set_header X-Forwarded-Proto $scheme;. Ensure another proxy has not replaced the value before Jenkins receives it. |
| WebSocket agents fail to connect. | Upgrade headers are dropped or the upstream uses HTTP/1.0. | Restore the map, Upgrade and Connection headers, and proxy_http_version 1.1. Reload Nginx and retest the same agent. |
| CLI output hangs or ends with an early EOF. | Request buffering or a short read timeout interrupts a long operation. | Keep proxy_request_buffering off and increase proxy_read_timeout beyond the operation’s real duration when needed. Change the timeout deliberately rather than masking a backend failure. |
| 404 responses, broken folder links, or a damaged Blue Ocean URL. | Nginx and Jenkins disagree about the context path, or proxy_pass rewrites it. |
Compare the public path, Jenkins prefix, and Nginx location character for character. Remove an unintended trailing slash from proxy_pass. |
| The certificate is correct but Nginx will not start. | The configured files do not exist or the process cannot read the private key. | Check the paths and permissions, then run nginx -t. Keep private-key access limited to the accounts that require it. |
| Nginx cannot read Jenkins web files. | Local filesystem permissions prevent the proxy user from reading required files. | Inspect ownership and modes first. Jenkins documents adding the Nginx or www-data user to the Jenkins group when web-root access is required; apply the least-privilege change that solves the specific permission error. |
Forwarded headers and trust boundaries
The four baseline headers in the official example carry different information. Host identifies the requested authority; X-Real-IP carries the immediate client address; X-Forwarded-For records the proxy chain; and X-Forwarded-Proto records whether the browser used HTTP or HTTPS. Jenkins uses this data when constructing redirects and links and when diagnosing proxy consistency.
Some multi-proxy layouts also require X-Forwarded-Host and X-Forwarded-Port. Add them only when your topology needs those values and ensure they are set by a trusted edge. Blindly accepting client-supplied forwarding headers lets a caller influence the URL Jenkins believes it is serving.
Operational security and maintenance
Renew certificates without an outage
Certificate renewal replaces files; it does not automatically make a running Nginx process use the new key and certificate. Your renewal job must validate the resulting Nginx configuration and reload Nginx. After renewal, open the public hostname and inspect the certificate presented to clients.
Free tools Windows power users keep installed
One-click scans. No signup required.
Monitor both layers
Keep Nginx access and error logs alongside Jenkins logs. A 502 or connection-refused entry usually points to the proxy-to-Jenkins hop; a Jenkins-generated 404 or redirect loop usually indicates URL, prefix, or header handling. Correlate timestamps and request paths before changing several directives at once.
Quick Recap
Limit exposure and permissions
- Allow public access to the intended TLS listener, not to Jenkins’ backend port.
- Restrict certificate private-key permissions and avoid broad group membership.
- Use firewall rules to enforce the chosen network boundary.
- Keep the Nginx, operating system, Java runtime, and Jenkins installation patched according to your maintenance policy.
- Review any additional load balancer or CDN in front of Nginx for header, redirect, timeout, and WebSocket behavior.
Deployment checklist
- DNS resolves the Jenkins hostname to the intended public endpoint.
- The certificate covers that exact hostname and Nginx can read both certificate files.
- Jenkins listens on the intended private address and direct public access is blocked.
Host,X-Real-IP,X-Forwarded-For, andX-Forwarded-Protoare forwarded.- WebSocket upgrade headers, the connection map, and HTTP/1.1 are present.
- Request buffering is disabled and proxy timeouts suit the longest expected operation.
- HTTP requests redirect to HTTPS for only the Jenkins hostname.
- The Jenkins prefix, Nginx location, and public URL use the same path.
nginx -tpasses before every reload.- Browser navigation, login redirects, a WebSocket feature, an HTTP CLI command, and Jenkins’ reverse-proxy monitor all pass.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
