He has nginx reverse proxy in front on another machine in his lan, so I suspect TLS is terminated there