diff --git a/.env.example b/.env.example
index a6f134ace..be7e0a621 100644
--- a/.env.example
+++ b/.env.example
@@ -70,3 +70,5 @@ NEXT_PUBLIC_CAPTCHA_SITE_KEY=
 
 PLAIN_API_KEY=
 PLAIN_WISH_LABEL_IDS=
+
+SSL_CLIENT_CERTIFICATE_HEADER_KEY=
diff --git a/backend/src/lib/config/env.ts b/backend/src/lib/config/env.ts
index 8a2b961e9..cd64c2912 100644
--- a/backend/src/lib/config/env.ts
+++ b/backend/src/lib/config/env.ts
@@ -141,7 +141,8 @@ const envSchema = z
     CAPTCHA_SECRET: zpStr(z.string().optional()),
     PLAIN_API_KEY: zpStr(z.string().optional()),
     PLAIN_WISH_LABEL_IDS: zpStr(z.string().optional()),
-    DISABLE_AUDIT_LOG_GENERATION: zodStrBool.default("false")
+    DISABLE_AUDIT_LOG_GENERATION: zodStrBool.default("false"),
+    SSL_CLIENT_CERTIFICATE_HEADER_KEY: zpStr(z.string().optional()).default("x-ssl-client-cert")
   })
   .transform((data) => ({
     ...data,
diff --git a/backend/src/server/routes/est/certificate-est-router.ts b/backend/src/server/routes/est/certificate-est-router.ts
index f1f242138..09c33f3a6 100644
--- a/backend/src/server/routes/est/certificate-est-router.ts
+++ b/backend/src/server/routes/est/certificate-est-router.ts
@@ -1,10 +1,13 @@
 import bcrypt from "bcrypt";
 import { z } from "zod";
 
+import { getConfig } from "@app/lib/config/env";
 import { BadRequestError, UnauthorizedError } from "@app/lib/errors";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
 
 export const registerCertificateEstRouter = async (server: FastifyZodProvider) => {
+  const appCfg = getConfig();
+
   // add support for CSR bodies
   server.addContentTypeParser("application/pkcs10", { parseAs: "string" }, (_, body, done) => {
     try {
@@ -99,7 +102,7 @@ export const registerCertificateEstRouter = async (server: FastifyZodProvider) =
       return server.services.certificateEst.simpleEnroll({
         csr: req.body,
         certificateTemplateId: req.params.certificateTemplateId,
-        sslClientCert: req.headers["x-ssl-client-cert"] as string
+        sslClientCert: req.headers[appCfg.SSL_CLIENT_CERTIFICATE_HEADER_KEY] as string
       });
     }
   });
@@ -126,7 +129,7 @@ export const registerCertificateEstRouter = async (server: FastifyZodProvider) =
       return server.services.certificateEst.simpleReenroll({
         csr: req.body,
         certificateTemplateId: req.params.certificateTemplateId,
-        sslClientCert: req.headers["x-ssl-client-cert"] as string
+        sslClientCert: req.headers[appCfg.SSL_CLIENT_CERTIFICATE_HEADER_KEY] as string
       });
     }
   });
diff --git a/nginx/default.dev.conf b/nginx/default.dev.conf
index 490fd23c3..4512b6311 100644
--- a/nginx/default.dev.conf
+++ b/nginx/default.dev.conf
@@ -13,7 +13,24 @@ server {
 
         proxy_cookie_path / "/; HttpOnly; SameSite=strict";
     }
-    
+
+    location /.well-known/est {
+
+        proxy_set_header X-Real-RIP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+
+        proxy_set_header Host $http_host;
+        proxy_set_header X-NginX-Proxy true;
+
+        proxy_set_header X-SSL-Client-Cert $ssl_client_escaped_cert;
+
+        proxy_pass http://backend:4000;
+        proxy_redirect off;
+
+        # proxy_cookie_path / "/; secure; HttpOnly; SameSite=strict";
+        proxy_cookie_path / "/; HttpOnly; SameSite=strict";
+    }
+
     location / {
         include /etc/nginx/mime.types;