Q:

Forward https client's header to backend application

I'm using nginx like reverse proxy to backend application.
- The clients connects to nginx with certificate-A.pem, and nginx use an intermediate CA chained with the root CA to validate the clients (ALL OK).
Now come the problem:
- nginx must forward the requests to the backend application using the same header used by the real host (containing the certificate-A.pem). The packets forwarded to the backend application must be identical to the clients packets recived by nginx.
Why? Because i've a very large number of clients to manage (every one with a different certificate issued by the same Intermediate CA), the backend need the certificate (used to do stuff) but i want to pre-verify this certificate with nginx (really fastest)
I've tired different configuration, but i can't figure how to proxy_set the correct header
upstream proxy_server {
 server     127.0.0.1:8443;  <---my backend application
}

server {
listen   443 ssl;
listen   [::]:443;

ssl_certificate   /home/mender/Projects/utility-scripts/gwsw-root-gen/cert_tree/intermediate_CA/gwsw/x509-med_ca_gwsw.pem;

ssl_certificate_key   /home/mender/Projects/utility-scripts/gwsw-root-gen/cert_tree/intermediate_CA/gwsw/x509-med_ca_gwsw-key.pem;

location / {
proxy_pass   https://proxy_server;
proxy_redirect          off;
proxy_set_header    Host             $host;
proxy_set_header    X-Real-IP        $remote_addr;
proxy_set_header    X-Forwarded-For  $proxy_add_x_forwarded_for;
proxy_set_header    X-Custom-Referrer $http_x_custom_referrer;
   }
}

Cannot verificate the certificate.

A:

The packets forwarded to the backend application must be identical to the clients packets recived by nginx.

If this is the case, I believe you need to just use nginx in stream mode acting as a TCP proxy. I don't know that you'd be able to do any validation on the nginx side however, it'll be purely be up to the backend application. 
Its not possible (I don't think) to both have nginx set up an SSL connection and also pass the encrypted data to the backend. 

