title: Reverse proxy on windows using docker - nginx is not forwarding https to IIS
body: <p>I have a win10 box where I run docker and two containers with Windows as depicted by the diagram below where one is running Nginx and acts as a reverse proxy to the other container running IIS.
  It works fine for http but the redirection from nginx to IIS fails for https.</p>
  <p>The individual containers accept https on its own so I know the certificates are installed correctly. I use self-signed certificates.
  I'm thinking that there might be a setting in <code>nginx.conf</code> that I am not aware of that is causing it.</p>
  <p>I can do</p>
  <pre><code>+---------------------------+--------------------------+------+
  | https://localhost         | points to nginx          | OK   | 
  +---------------------------|--------------------------|------|
  | https://localhost:5003    | points to iis            | OK   |
  +---------------------------|--------------------------|------|
  | https://localhost/mysite  | points to iis via nginx  | FAIL |
  +---------------------------+--------------------------+------+
  </code></pre>
  <p><a href="https://i.stack.imgur.com/vr66d.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/vr66d.png" alt="enter image description here" /></a></p>
  <p>And the error:</p>
  <p><a href="https://i.stack.imgur.com/cUKlv.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/cUKlv.png" alt="enter image description here" /></a></p>
  <p>There are questions  e.g. <a href="https://stackoverflow.com/q/47818667">this</a> and <a href="https://stackoverflow.com/q/42172023/2545927">this</a>  but they refer to http only.
  There is a <a href="https://www.digitalocean.com/community/tutorials/how-to-configure-nginx-with-ssl-as-a-reverse-proxy-for-jenkins" rel="nofollow noreferrer">tutorial</a>  on DigitalOcean that describes how to set up nginx with https which I have largely followed but it still doesn't work.</p>
  <p><em>Nginx - access.log:</em></p>
  <p><code>&quot;GET /mysite HTTP/1.1&quot; 504 585 &quot;-&quot; &quot;Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36&quot;</code></p>
  <p><em>Nginx - error.log:</em></p>
  <p><code>*5 upstream timed out (10060: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond) while connecting to upstream, client: 172.18.0.1, server: localhost, request: &quot;GET /mysite HTTP/1.1&quot;, upstream: &quot;https://172.18.0.2:5003/&quot;, host: &quot;localhost&quot;</code></p>
  <p><em>IIS Logs:</em></p>
  <p>C:\inetpub\logs is empty</p>
  <h2>Question</h2>
  <p>How can make nginx forward https to the IIS container?</p>
  <hr />
  <h3>Setup</h3>
  <p><em>Setting up docker network:</em>
  <code>docker network create -d nat --subnet=172.18.0.0/16  nginx-proxy-network</code></p>
  <p><em>Build commands:</em></p>
  <pre><code>cd nginx-proxy
  docker build -t nginx-proxy .
  Cd ..\iis
  Docker build -t iis .
  </code></pre>
  <p><em>Starting nginx container:</em>
  <code>docker run -d -p 80:80 -p 443:443 --network nginx-proxy-network --ip 172.18.0.3  nginx-proxy</code></p>
  <p><em>Starting iis container:</em>
  <code>docker run -d -p 5002:80 -p 5003:443 --network nginx-proxy-network --ip 172.18.0.2 iis</code></p>
  <p><strong>Nginx</strong></p>
  <p><em>Generate certificates for nginx<sup><a href="https://www.liberiangeek.net/2015/10/how-to-install-self-signed-certificates-on-nginx-webserver/" rel="nofollow noreferrer">1</a></sup>:</em>
  <code>C:\openssl\openssl.exe genrsa -des3 -out localhost.key 2048</code></p>
  <p><code>C:\openssl\openssl.exe req -new -key localhost.key -out localhostcsr -config C:\openssl\openssl.conf</code></p>
  <p><code> C:\openssl\openssl.exe x509 -req -days 365  -in localhost.csr -signkey localhost.key -out localhost.crt</code></p>
  <p>It asks for a password that I then store in a txt file.</p>
  <p><em>Nginx.conf:</em></p>
  <pre><code>worker_processes 1;
  events {
      worker_connections 1024;
  }
  
  http {
      include mime.types;
      default_type application/octet-stream;
      sendfile on;
      keepalive_timeout 65;
      server {
          listen 80;
          server_name localhost ; 
  
          location /mysite {
              proxy_pass http://172.18.0.2/; 
              proxy_set_header X-Real-IP $remote_addr;
              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
              proxy_set_header X-Forwarded-Proto $scheme;
          }
          location / {
              root html;
              index index.html index.htm;
          }
  # redirect server error pages to the static page /50x.html
  #
          error_page 500 502 503 504 /50x.html;
          location = /50x.html {
              root html;
          }
  }
  # HTTPS server
      server {
          listen *:443 ssl;
          server_name localhost ;
          ssl on;
          ssl_password_file C:\cert\pwdcert.txt; 
          ssl_certificate C:\cert\localhost.crt; 
          ssl_certificate_key C:\cert\localhost.key;
          ssl_session_cache shared:SSL:1m;
          ssl_session_timeout 5m;
          ssl_ciphers HIGH:!aNULL:!MD5;
          ssl_prefer_server_ciphers on;
          add_header Strict-Transport-Security &quot;max-age=63072000;        includeSubdomains; preload&quot;;
          add_header X-Frame-Options DENY;
          add_header X-Content-Type-Options nosniff;
          add_header X-Frame-Options &quot;SAMEORIGIN&quot;;
  
          location /mysite {
              proxy_pass https://172.18.0.2:5003/;
              # proxy_set_header Host $host;
              proxy_set_header X-Real-IP $remote_addr;
              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
              proxy_set_header X-Forwarded-Proto $scheme;
          }
  
          location / {
              root html;
              index index.html index.htm;
          }
      }
  }
  </code></pre>
  <p><em>Nginx - Docker file:</em></p>
  <pre><code>FROM microsoft/windowsservercore
  COPY nginx/ /nginx
  RUN mkdir &quot;C:\\cert&quot; 
  COPY *.crt /cert
  COPY *.key /cert
  COPY pwdcert.txt /cert
  WORKDIR /nginx
  CMD [&quot;nginx&quot;]
  </code></pre>
  <p><strong>IIS</strong></p>
  <p><em>IIS Docker file:</em></p>
  <pre><code>FROM microsoft/aspnet
  COPY iisscripts.ps1 /
  RUN powershell -noexit &quot;C:\iisscripts.ps1&quot;
  COPY mysite/ /inetpub/wwwroot/
  </code></pre>
  <p><em>iisscripts.ps1:</em></p>
  <pre><code>$cert = New-SelfSignedCertificate -DnsName &quot;localhost&quot; -    CertStoreLocation cert:\LocalMachine\My
  New-WebBinding -Name &quot;Default Web Site&quot; -IP &quot;*&quot; -Port 443 -Protocol https
  new-item -path IIS:\SslBindings\0.0.0.0!443 -Value $cert
  </code></pre>