nginx在反向代理侧实现ssl

被代理的webserver为lnmp项目，现在需要在反向代理侧使用nginx实现ssl的反向代理(域名解析在反代的ip上)，配置如下：

upstream XXX {
server 192.168.0.233:80;    #real server的IP及端口
}

server {
listen 80;
server_name XXXXXX.com;
if ( \$host = "XXXXXX.com" ){
rewrite ^/(.*)$ https://XXXXXX.com permanent;
}  #if判断换成return 301 https://XXXXXX.com$request_uri;亦可
}

server {
listen 443;
server_name XXXXXX.com;   #反向代理上对外访问的真实域名
ssl on;
ssl_certificate cert/XXXXXXXX;
ssl_certificate_key cert/XXXXXXXX;
ssl_session_timeout 5m;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;

location / {

proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_pass http://XXX;   #XXX为上面upstream定义的域名（非真实域名）
}

access_log /usr/local/nginx/logs/XXX_access.log;
error_log /usr/local/nginx/logs/XXX_error.log error;

}