How to stop nginx pass through from resolving upstream to IP - nginx

Question

I am new to nginx reverse proxy configuration. We have a requirement to setup a proxy server to route requests to a remote server that requires IP whitelisting. Two way SSL is also in place.
We have been trying to it up hit a roadblock. Following is the configuration :
server {
listen 80;
server_name myserver.com;
return 302 https://myserver.com;
}
server {
listen 443;
server_name myserver.com;
ssl on;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
ssl_certificate /etc/nginx/keys/my-net.crt;
ssl_certificate_key /etc/nginx/keys/my-net.key;
access_log /var/log/nginx/access.log;
error_log /var/log/nginx/error.log;
location / {
resolver 8.8.8.8;
set $backend "https://remoteserver.com";
proxy_pass $backend;
proxy_ssl_server_name on;
proxy_ssl_trusted_certificate /home/ubuntu/myfile.pem;
proxy_ssl_session_reuse off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwared-For $proxy_add_x_forwarded_for;
}
}
The problem we are facing is that the proxy server is resolving the domain name to IP because of which SSLhandshake is failing. We need to stop this and hit the domain name because the certificate is on the domain name.
Error from error.log
2022/03/02 14:10:02 [error] 27012#27012: *8 SSL_do_handshake() failed (SSL: error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:SSL alert number 40) while SSL handshaking to upstream, client: <>, server: <>, request: "POST <> HTTP/1.1", upstream: "https:<>", host: "<>"
2022/03/02 14:10:02 [alert] 27012#27012: *8 socket() failed (97: Address family not supported by protocol) while connecting to upstream, client: <>, server: <>, request: "POST /gateway/api/txb/v1/payments/transfer-payment HTTP/1.1", upstream: "https://[IPv6]:443/", host: "<>"
Already tried the solution here but no luck - How to stop nginx from resolving upstream to ip?

Answer 1

You need to off proxy_pass_request_headers after that set headers with proxy_set_heder and listen ssl listen 443 ssl;
server {
listen 80;
server_name myserver.com;
return 302 https://myserver.com;
}
server {
listen 443 ssl;
server_name myserver.com;
ssl on;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
ssl_certificate /etc/nginx/keys/my-net.crt;
ssl_certificate_key /etc/nginx/keys/my-net.key;
access_log /var/log/nginx/access.log;
error_log /var/log/nginx/error.log;
location / {
resolver 8.8.8.8;
set $backend "https://remoteserver.com";
proxy_pass $backend;
proxy_ssl_server_name on;
proxy_ssl_trusted_certificate /home/ubuntu/myfile.pem;
proxy_ssl_session_reuse off;
proxy_pass_request_headers off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwared-For $proxy_add_x_forwarded_for;
}
}