server.crt
and server.key
should be the paths to your certificate and your private key, respectively.
X-Real-IP is the IP of the client connected to the proxy. It is important to use it when you need to retrieve the IP of the connected client, otherwise you will end up with the IP of the proxy. You should check your application server API on how to set it (desirable) or retrieve it from the request headers.
You MUST use CA signed certificates on production environment.
Let's Encrypt is a new project that will be launched on 2015 Q4 that promises to allow you to get trustworthy certificates for free.
From now, rely on commercial ones like DigiCert, Comodo, or GoDaddy.