diff --git a/nginx.conf b/nginx.conf
index 4623503..cf19d77 100644
--- a/nginx.conf
+++ b/nginx.conf
@@ -38,19 +38,6 @@ http {
         }
     }
 
-    # rancher https: the destination container will handle tls
-    server {
-        listen 2001;
-
-        location / {
-          proxy_pass https://rancher:443;
-          proxy_set_header Host $host;
-          proxy_set_header X-Real-IP $remote_addr;
-          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-          proxy_set_header X-Forwarded-Proto $scheme;
-        }
-    }
-
     # kubernetes cluster hello world
     server {
         listen 80;
@@ -66,6 +53,12 @@ http {
 }
 
 stream {
+    # rancher https: passthrough ssl
+    server {
+      listen     2001;
+      proxy_pass rancher:443;
+    }
+
     # kubernetes cluster api
     server {
         listen 3080;