Access to webserver behind nginx reverse-proxy from outside fails with SSL handshaking error

Question

I have a setup where there are a number of Apache web servers behind a common Nginx reverse proxy server. But I can not access the web servers from the Internet. The access works fine on my local network, so I suspect my Apache setup is correct. But I'm not 100% sure as an attempt at internet connection triggers two error messages - one from the Nginx server and one from the Apache server.

The Nginx server reports the following error: "no ssl_certificate is defined in server listening on SSL port while SSL handshaking" and the Apache web server comes with this error: "authz_core error ... AH01630 client denied by server configuration".

The configuration of the Nginx reverse proxy server is divided into two files - one for HTTP traffic and one for HTTPS:

<example_dk_80.conf>:
server {
    listen 80;
    server_name example.dk www.example.dk;
    return      301 https://$server_name$request_uri;
}

<example_dk_443.conf>:
server {
    listen 443 ssl http2;
    server_name example.dk www.example.dk;

    add_header Strict-Transport-Security "max-age=31536000";

    ssl on;
    ssl_certificate         /etc/ssl/certs/example_dk.crt;
    ssl_certificate_key     /etc/ssl/private/example_dk.key;
    ssl_trusted_certificate /etc/ssl/certs/example_dk.ca-bundle;
    ssl_protocols           TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_ciphers             HIGH:!aNULL:!MD5;
    ssl_session_cache shared:SSL:10m;
    ssl_session_tickets off;
    ssl_stapling on;
    ssl_stapling_verify on;

    resolver 172.16.1.10 8.8.8.8 8.8.4.4 valid=300s;
    resolver_timeout 5s;

    location /.well-known {
       alias /var/www/example_dk/.well-known;
    }
    location / {
        proxy_pass http://172.16.1.51:443;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

My Apache web servers (with WordPress) are configured as follows:

<vhost.conf>:
DirectoryIndex index.php index.html

<VirtualHost *:80>
  ServerName example.dk
  ServerAlias www.example.dk
  DocumentRoot "/var/www/example_dk"

  <Directory "/var/www/example_dk">
    AllowOverride All
    Options Indexes FollowSymLinks MultiViews
    AllowOverride All
    Require all granted
  </Directory>
</VirtualHost>

<VirtualHost *:443>
  ServerName example.dk
  ServerAlias www.example.dk
  DocumentRoot "/var/www/example_dk"

  SSLEngine on
  SSLCipherSuite AES256+EECDH:AES256+EDH
  SSLProtocol All -SSLv2 -SSLv3
  SSLHonorCipherOrder On
  SSLCompression off
  SSLCertificateFile /etc/ssl/certs/example_dk.crt
  SSLCertificateKeyFile /etc/ssl/private/example_dk.key
  SSLCertificateChainFile /etc/ssl/certs/example_dk.ca-bundle

  <Directory "/var/www/example_dk">
    AllowOverride None
    Options Indexes FollowSymLinks MultiViews
    Require all granted
  </Directory>
</VirtualHost>

I do not know if it makes a difference, but here is the htaccess file for my WordPress installation:

<.htaccess>:
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

## Security
<Files xmlrpc.php>
Require all denied
</Files>

<Files wp-config.php>
Require all denied
</Files>

Options -Indexes

## SSL
#Header set Strict-Transport-Security "max-age=31536000" env=HTTPS

## Force www
RewriteEngine on
RewriteCond %{HTTP_HOST} ^example.dk [NC]
RewriteRule ^(.*)$ http://www.example.dk/$1 [L,R=301,NC]

## Force https
RewriteEngine On
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

All my servers are running Ubuntu 18.04.

Answer 1

   proxy_pass http://172.16.1.51:443;

Since the specified protocol is http:// This tells nginx to access the server at port 443 with plain HTTP. Given that the server at this port is configured with HTTPS though this will fail. Instead either the protocol should be given as https:// to access the server with HTTPS on port 443 or it should be given as http:// and the (default) port 80 to access the server with plain HTTP on the the port expected for plain HTTP.