server {
    listen                      443 ssl;
    server_name                 example.com;
    server_tokens               off;

    access_log /etc/nginx/access.log;
    error_log /etc/nginx/example.log;

    ssl_certificate             /etc/nginx/certs/example.pem;
    ssl_certificate_key         /etc/nginx/certs/example.key;
    ssl_client_certificate      /etc/nginx/certs/example_server_ca.crt;
    ssl_verify_client           on;
    ssl_verify_depth            2;
    ssl_prefer_server_ciphers   on;
    ssl_session_tickets off;
    ssl_session_cache off;

    location / {
        proxy_http_version      1.1;
        proxy_ignore_headers    Set-Cookie;
        proxy_hide_header       Vary;

        proxy_set_header        Host             $http_host;
        proxy_set_header        X-Real-IP        $remote_addr;
        proxy_set_header        X-Forwarded-For  $proxy_add_x_forwarded_for;
        proxy_set_header        X-SSL-CERT       $ssl_client_escaped_cert;

        proxy_pass              http://127.0.0.1:serverPort;

        add_header Access-Control-Allow-Origin         https://server.example.com;
        add_header Access-Control-Allow-Credentials    true;
   }
}