Avatar, Site Logos, and Cert Errors

So, to not use SSL on my externally facing proxy but rather forward plain http requests onto Discourse server and allow force_https to handle those requests? How does the cert then get passed? Via the first the Nginx instance? This is where things break down for me.