You are absolutely correct as nginx-proxy handles the SSL for all before passing to the container. Of course, if you were in a multi-tenant situation, you wouldn’t want them to have direct access to that directory since other people’s certs are also in there.