What role does a reverse proxy play in TLS/SSL termination, and why is this pattern common in production deployments?

TLS termination at the reverse proxy (nginx, a cloud load balancer, IIS) means the proxy handles the computationally expensive TLS handshake and decryption, then forwards the request to the backend application (Kestrel) as plain HTTP over the internal, typically trusted network -- this centralizes certificate management at one layer (the proxy), reduces CPU load on individual application instances, and simplifies certificate rotation/renewal to a single location rather than needing to manage TLS certificates on every application instance.

# nginx.conf -- TLS terminated here, plain HTTP forwarded to the app
server {
    listen 443 ssl;
    ssl_certificate /etc/ssl/cert.pem;
    ssl_certificate_key /etc/ssl/key.pem;
    location / {
        proxy_pass http://localhost:5000;  // plain HTTP to Kestrel
        proxy_set_header X-Forwarded-Proto https;
    }
}