Introduction
Nginx is a high-performance web server commonly used to host websites and web applications. Installing an SSL certificate helps secure communication between the website and its visitors by enabling HTTPS.
In this article, we will explain how to install and configure an SSL certificate on an Nginx web server running Ubuntu 16.04.
Prerequisites
Before proceeding, make sure you have the following:
- Ubuntu 16.04 server.
- Nginx web server installed and configured.
- Root or sudo access to the server.
- SSL private key.
- SSL certificate.
- Intermediate CA certificate.
If the SSL certificate signing request (CSR) was generated on the same server, make sure the corresponding private key is available on the server.
If Nginx is not installed, install and configure Nginx before proceeding.
Implementation
1. Create an SSL Directory
This article assumes that Nginx is installed under /etc/nginx.
Create a directory to store the SSL certificate and private key:
mkdir /etc/nginx/ssl
2. Copy the Private Key
Copy the SSL private key to the newly created directory:
cp /location/domain.tld.key /etc/nginx/ssl/
Replace /location/domain.tld.key with the actual location of your private key.
Make sure the private key has appropriate permissions and is accessible only to authorized users.
3. Copy the SSL Certificate and Intermediate CA
Copy the SSL certificate and intermediate CA certificate to the server.
For example, the files may be available under:
/usr/local/src/domain.tld.crt
/usr/local/src/domain.tld.ca
The certificate and intermediate CA can be transferred to the server using an appropriate secure file transfer method.
4. Combine the Certificate and Intermediate CA
Combine the SSL certificate and intermediate CA into a single PEM file:
cd /usr/local/src
Then run:
cat domain.tld.crt domain.tld.ca > /etc/nginx/ssl/domain.tld.pem
The resulting PEM file will contain both the domain certificate and intermediate CA certificate.
5. Configure SSL Ciphers
Open the main Nginx configuration file:
vi /etc/nginx/nginx.conf
Add or update the SSL cipher configuration after the appropriate SSL configuration:
ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
For older Nginx/OpenSSL versions, available cipher suites may differ. Verify compatibility with the installed Nginx and OpenSSL versions before applying a production configuration.
6. Configure the SSL Certificate for the Website
Open the website’s Nginx configuration file.
For this example, we assume the website configuration is:
vi /etc/nginx/sites-enabled/default
If multiple websites are hosted on the server, update the configuration file corresponding to the required domain.
Add the HTTPS server block:
server {
listen 443 ssl http2 default_server;
listen [::]:443 ssl http2 default_server;
root /var/www/html;
ssl_certificate /etc/nginx/ssl/domain.tld.pem;
ssl_certificate_key /etc/nginx/ssl/domain.tld.key;
index index.php index.html index.htm;
server_name domain.tld www.domain.tld;
location / {
try_files $uri $uri/ /index.php?$args;
}
}
Update the following values according to your environment:
domain.tld— Replace with your actual domain./var/www/html— Replace with the actual website document root.- SSL certificate and private key paths — Update if different.
7. Check the Nginx Configuration
Before restarting Nginx, always test the configuration:
nginx -t
A successful configuration test should return:
syntax is ok
test is successful
If Nginx reports an error, fix the configuration before proceeding.
8. Restart Nginx
Once the configuration test is successful, restart Nginx:
systemctl restart nginx
You can also verify the Nginx service status:
systemctl status nginx
Verification
Open the website using HTTPS:
https://domain.tld
You can also verify the SSL certificate using an SSL testing service.
For example, use the SSL Labs SSL Server Test and enter your domain to check the certificate, certificate chain, supported protocols, and cipher configuration.
Conclusion
Installing an SSL certificate on Nginx enables HTTPS and helps protect communication between the website and its visitors.
The basic process involves copying the private key and certificates to the server, combining the certificate and intermediate CA, updating the Nginx configuration, testing the configuration, and restarting Nginx.
Always run nginx -t before restarting Nginx to avoid configuration-related service interruptions.
FAQs
1. What files are required to install an SSL certificate on Nginx?
You generally need the private key, SSL certificate, and intermediate CA certificate provided by the certificate authority.
2. Where should I store the SSL certificate and private key?
In this example, they are stored under:
/etc/nginx/ssl/
The private key should be protected with appropriate file permissions.
3. Why do we combine the SSL certificate and intermediate CA?
Combining them into a PEM file allows Nginx to provide the required certificate chain to clients during the TLS connection.
4. How can I check whether the Nginx configuration is correct?
Run:
nginx -t
Do not restart Nginx if this command reports an error.
Related Article
How to setup SSL Certificate in Nginx on Ubuntu 20.04 – Pheonix Solutions
Install Nginx on cPanel Using Engintron (Step-by-Step Guide)
Talk to our experts
Have a technology challenge or looking for the right solution for your business? Our team can help you with cloud, DevOps, development, infrastructure, design, and more. Feel free to reach out to our experts here.