> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/proxy/use-nginx-as-a-reverse-proxy-to-the-server.md).

# Use NGINX as a Reverse Proxy to the Server

Configure NGINX as a reverse proxy for a Cortex XSOAR 6.14 server.

NGINX can act as a reverse proxy that sits between internal applications and external clients, forwarding client requests to the appropriate application. Using NGINX as a reverse proxy in front of the Cortex XSOAR server enables you to provide network segmentation where the proxy can be put on a public subnet (DMZ) while the Cortex XSOAR server can be on a private subnet, only accepting traffic from the proxy. Additionally, NGINX provides a number of advanced load balancing and acceleration features that you can utilize.

The following topics describe how to install NGINX, how to use a Self-Signed Certificate for non-production environments, and how to configure NGINX.

* [Install NGINX on the Server](#install-nginx-on-the-server)
* [Generate a Certificate for NGINX](#generate-a-certificate-for-nginx)
* [Configure NGINX](#configure-nginx)

**Use Engines Through the NGINX Reverse Proxy**

If you want to use a Cortex XSOAR Engine (d1) through the reverse proxy, you need to modify the following entry in the `d1.conf` file to point to the host and port the NGINX server is listening on: **`EngineURLs`**

### **Install NGINX on the Server**

You can install NGINX on the Red Hat/Amazon (yum) and Ubuntu Linux distributions. For full instructions and available distributions, see [NGINX documentation](https://docs.nginx.com/nginx/admin-guide/installing-nginx/installing-nginx-open-source/).

1. Run one of the following commands according to your Linux system:
   * **RedHat/Amazon**: **`sudo yum install nginx`**
   * **Ubuntu**: **`sudo apt-get install nginx`**
2. (Optional) Verify the NGINX installation by running the following command:

   **`sudo nginx -v`**

### **Generate a Certificate for NGINX**

You should not use self-signed certificates for production systems. It is recommended to use a properly signed certificate for production systems. These instructions are intended only for non-production setups.

1. To use OpenSSL to generate a self-signed certificate, run the following command:

   **`sudo openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout /etc/nginx/cert.key -out /etc/nginx/cert.crt`**
2. When prompted, complete the on-screen instructions for the required fields.

### **Configure NGINX**

Follow these instructions to configure NGINX on Cortex XSOAR.

{% hint style="info" %}

### Note

For multi-tenant deployments, replace **`location ~ ^/(websocket|d1ws|d2ws) {`** with **`location ~ ^/(acc_\S+/|host_\S+/)?(websocket|d1ws|d2ws) {`** in the configuration template below.
{% endhint %}

1. Open the following NGINX configuration file with your preferred editor:

   `/etc/nginx/conf.d/demisto.conf`
2. Use the following configuration template:

   Replace **`DEMISTO_SERVER`** with the appropriate hostname.

   ```programlisting
   # Replace DEMISTO_SERVER with the appropriate hostname. If needed, change port 443 to the port on which the Demisto server is listening.

   upstream demisto {
       server DEMISTO_SERVER:443;
   }

   # Uncomment to redirect http to https (optional)
   # server {
   #     listen 80;
   #     return 301 https://$host$request_uri;
   # }

   server {
      # Change the port if you want NGINX to listen on a different port
       listen 443;
       
       ssl_certificate           /etc/nginx/cert.crt;
       ssl_certificate_key       /etc/nginx/cert.key;

       ssl on;
       ssl_session_cache  builtin:1000  shared:SSL:10m;
       ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;
       ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
       ssl_prefer_server_ciphers on;

       access_log            /var/log/nginx/demisto.access.log;

       location / {

         proxy_set_header        Host $host;
         proxy_set_header        X-Real-IP $remote_addr;
         proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header        X-Forwarded-Proto $scheme;

         proxy_pass          https://demisto;
         proxy_read_timeout  90;
       }

       location ~ ^/(websocket|d1ws|d2ws) {
           proxy_pass https://demisto;
           proxy_http_version 1.1;
           proxy_set_header Upgrade $http_upgrade;
           proxy_set_header Connection "upgrade";
           proxy_set_header Host $host;
           proxy_set_header Origin "";
           proxy_set_header X-Real-IP $remote_addr;
           proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
           proxy_set_header X-Forwarded-Proto $scheme;
       }
   }
   ```
3. Restart the NGINX server, by typing the following command:

   **`sudo service nginx restart`**
4. Verify you can access Cortex XSOAR by browsing to the NGINX server host.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/proxy/use-nginx-as-a-reverse-proxy-to-the-server.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.