What will nginx reverse-proxy do with ‘proxy_redirect’ to https when a backend has invalid https certificate

The location blocks have nothing similar, so combining them with a regex is a bit time consuming and complicated.

Instead, we can just route all the requests to the DSM.

There are three methods to have multiple DSM servers without clashing.

Method #1: Virtual Hosts

You will need to configure your DNS to point your chosen virtual host at the NGINX server.

http {
    #DSM 1 Standard DSM setup
    upstream dsm1 {
        server 1.1.1.1:5000;
    }
    #DSM 2 - DSM has different Port, same IP Address
    upstream dsm2 {
        server 1.1.1.1:6000;
    }
    #DSM 3 - DSM has different IP Address
    upstream dsm3 {
        server 2.1.1.1:5000;
    }
    #DSM 1 Standard DSM setup
    server {
        listen       80;
        server_name dsm1.mydomain.com;
        location / {
            include proxy_headers;
            proxy_pass http://dsm1/;
    }
    #DSM 2 - DSM has different Port, same IP Address
    server {
        listen       80;
        server_name dsm2.mydomain.com;
        location / {
            include proxy_headers;
            proxy_pass http://dsm2/;
    }
    #DSM 3 - DSM has different IP Address
    server {
        listen       80;
        server_name dsm3.mydomain.com;
        location / {
            include proxy_headers;
            proxy_pass http://dsm3/;
    }

Method #2, Different NGINX ports

Each server can be accessed on it's own port on the NGINX server

http {
    #DSM 1 Standard DSM setup
    upstream dsm1 {
        server 1.1.1.1:5000;
    }
    #DSM 2 - DSM has different Port, same IP Address
    upstream dsm2 {
        server 1.1.1.1:6000;
    }
    #DSM 3 - DSM has different IP Address
    upstream dsm3 {
        server 2.1.1.1:5000;
    }
    #DSM 1 Standard DSM setup
    server {
        listen       80;
        location / {
            include proxy_headers;
            proxy_pass http://dsm1/;
    }
    #DSM 2 This DSM server is available on another port (8081). Access using http://nginx_ip:8081
    server {
        listen       81;
        location / {
            include proxy_headers;
            proxy_pass http://dsm1/;
    }
}

Method #3: Rewrites

Each server can be accessed via a sub-url on the NGINX server. May not work depending on the DSM webpage configuration, and whether or not it has relative instead of absolute URLs.

http {
    #DSM 1
    upstream dsm1 {
      server 1.1.1.1:5000
    }
    #DSM 2
    upstream dsm2 {
      server: 1.1.1.2:5000
    }
    server {
      listen 80;
      location /dsm1/(?<dsmurl>.*) {
        include proxy_headers;
        proxy_pass http://dsm1/$dsmurl
      }
      location /dsm2/(?<dsmurl>.*) {
        include proxy_headers;
        proxy_pass http://dsm2/$dsmurl
      }
     }
}

(Expanded based on feedback on comments)

That server is configured to require protocol version TLSv1.2 (only), and ciphersuites using at least one of AES-GCM or 256-bit AES, with either DHE or ECDHE key exchange (for which OpenSSL and thus nginx uses variant spellings EDH and EECDH in some cases including this one).

JSSE client in Oracle or OpenJDK JDK7 does not offer TLSv1.2 or 1.1 by default (don't know for IBM, which has its own crypto providers) but they are implemented and can be enabled; for (Https)URLConnection this can be done with system property https.protocols. (Or by overlaying its socket factory, but the system property is usually easier.) But JDK7 does not implement GCM, and Oracle versions (but NOT OpenJDK ones) prohibit 256-bit symmetric encryption unless you install the "JCE Unlimited Strength Jurisdiction Policy Files" from the Oracle website; see https://stackoverflow.com/a/33712287/2868801 and possibly https://stackoverflow.com/questions/30350120/sslhandshakeexception-while-connecting-to-a-https-site

In contrast JDK8 (Oracle and OpenJDK) offers TLSv1.2 and 1.1 by default, and implements GCM, so it can connect without the Unlimited Strength policy.

Both 7 and 8 support DHE and ECDHE key exchange. But for anyone else in a similar situation with JDK6: ECDHE does not work unless you add a third-party provider for ECC primitives like bcprov from http://www.BouncyCastle.org