I wish to set up a new website that will be accessed by users using HTTPS. I think it is good practise to put the "real" web server in a seperate subnet, and then install an Apache Reverse Proxy in a DMZ.

My question is, where should I put the SSL cert(s)? Should I

a) Use a self-signed cert on the "real" web server, and a proper cert on the reverse proxy?

b) Use 2 real certs on both the "real" web server and the reverse proxy?

c) Don't use any cert on the "real" web server, and use a proper cert on the reverse proxy?

I'd like to use a) or c), if possible. I also don't want anyone's browser complaining of a self-signed cert.

Thanks