nginx will act as an endpoint for ssl so any cert needs to be at nginx's end. Posted at Nginx Forum: http://forum.nginx.org/read.php?2,255840,255842#msg-255842