Encontrei minha própria resposta
No nginx SSL, isso ...
proxy_set_header X-Forwarded-Proto https;
depois no verniz, isso ...
sub vcl_recv {
if (req.http.X-Forwarded-Proto == "https" ) {
set req.http.X-Forwarded-Port = "443";
} else {
set req.http.X-Forwarded-Port = "80";
set req.http.X-Forwarded-Proto = "http";
}
}
então no nginx final, isso ...
fastcgi_param SERVER_PORT $http_x_forwarded_port;