Where, when proxying, should the certificate be installed?

Question

Nginx

I use the following construct in Nginx settings to redirect requests to Tornado server

server {
    listen      80;
    listen [::]:80;
    server_name my.ru;
    rewrite     ^   https://$server_name$request_uri? permanent;
}
server {
  listen 443;
  listen [::]:443;

  server_name my.ru;

  location / {
      proxy_pass https://localhost:22817/;
  }
}

Where should the SSL certificate be installed, on the side of the Tornado server, or in the Nginx config?

Answer 1

As a general rule, the closer to the internet, the better. Local interaction usually does not need encryption, this is an extra overhead.