The frontend stream proxy_pass can be used for load-balancing without SSL off-loading. All SSL connections will be terminated on the backend and client certificate information can be properly authenticated.
This should be used in cases:
- you have enough CPU to decrypt SSL on the backend servers
- you require direct client AUTHENTICATION on the backend servers