Nginx is a high-performance web server commonly used to host websites and web applications. Installing an SSL certificate helps secure communication between the website and its visitors by enabling HTTPS.<\/p>\n\n\n\n
In this article, we will explain how to install and configure an SSL certificate on an Nginx web server running Ubuntu 16.04<\/strong>.<\/p>\n\n\n\n Before proceeding, make sure you have the following:<\/p>\n\n\n\n If the SSL certificate signing request (CSR) was generated on the same server, make sure the corresponding private key is available on the server.<\/p>\n\n\n\n If Nginx is not installed, install and configure Nginx before proceeding.<\/p>\n\n\n\n This article assumes that Nginx is installed under Create a directory to store the SSL certificate and private key:<\/p>\n\n\n\n Copy the SSL private key to the newly created directory:<\/p>\n\n\n\n Replace Make sure the private key has appropriate permissions and is accessible only to authorized users.<\/p>\n\n\n\n Copy the SSL certificate and intermediate CA certificate to the server.<\/p>\n\n\n\n For example, the files may be available under:<\/p>\n\n\n\n The certificate and intermediate CA can be transferred to the server using an appropriate secure file transfer method.<\/p>\n\n\n\n Combine the SSL certificate and intermediate CA into a single PEM file:<\/p>\n\n\n\n Then run:<\/p>\n\n\n\n The resulting PEM file will contain both the domain certificate and intermediate CA certificate.<\/p>\n\n\n\n Open the main Nginx configuration file:<\/p>\n\n\n\n Add or update the SSL cipher configuration after the appropriate SSL configuration:<\/p>\n\n\n\n For older Nginx\/OpenSSL versions, available cipher suites may differ. Verify compatibility with the installed Nginx and OpenSSL versions before applying a production configuration.<\/p>\n<\/blockquote>\n\n\n\n Open the website’s Nginx configuration file.<\/p>\n\n\n\n For this example, we assume the website configuration is:<\/p>\n\n\n\n If multiple websites are hosted on the server, update the configuration file corresponding to the required domain.<\/p>\n\n\n\n Add the HTTPS server block:<\/p>\n\n\n\n Update the following values according to your environment:<\/p>\n\n\n\n Before restarting Nginx, always test the configuration:<\/p>\n\n\n\n A successful configuration test should return:<\/p>\n\n\n\n If Nginx reports an error, fix the configuration before proceeding.<\/p>\n\n\n\n Once the configuration test is successful, restart Nginx:<\/p>\n\n\n\n You can also verify the Nginx service status:<\/p>\n\n\n\n Open the website using HTTPS:<\/p>\n\n\n\n You can also verify the SSL certificate using an SSL testing service.<\/p>\n\n\n\n For example, use the SSL Labs SSL Server Test<\/strong> and enter your domain to check the certificate, certificate chain, supported protocols, and cipher configuration.<\/p>\n\n\n\n Installing an SSL certificate on Nginx enables HTTPS and helps protect communication between the website and its visitors.<\/p>\n\n\n\n The basic process involves copying the private key and certificates to the server, combining the certificate and intermediate CA, updating the Nginx configuration, testing the configuration, and restarting Nginx.<\/p>\n\n\n\n Always run You generally need the private key<\/strong>, SSL certificate<\/strong>, and intermediate CA certificate<\/strong> provided by the certificate authority.<\/p>\n\n\n\n In this example, they are stored under:<\/p>\n\n\n\n The private key should be protected with appropriate file permissions.<\/p>\n\n\n\n Combining them into a PEM file allows Nginx to provide the required certificate chain to clients during the TLS connection.<\/p>\n\n\n\n Run:<\/p>\n\n\n\n Do not restart Nginx if this command reports an error.<\/p>\n\n\n\n How to setup SSL Certificate in Nginx on Ubuntu 20.04 – Pheonix Solutions<\/a><\/p>\n\n\n\nPrerequisites<\/h2>\n\n\n\n
\n
Implementation<\/h2>\n\n\n\n
1. Create an SSL Directory<\/h3>\n\n\n\n
\/etc\/nginx<\/code>.<\/p>\n\n\n\nmkdir \/etc\/nginx\/ssl<\/pre>\n\n\n\n
2. Copy the Private Key<\/h3>\n\n\n\n
cp \/location\/domain.tld.key \/etc\/nginx\/ssl\/<\/pre>\n\n\n\n
\/location\/domain.tld.key<\/code> with the actual location of your private key.<\/p>\n\n\n\n3. Copy the SSL Certificate and Intermediate CA<\/h3>\n\n\n\n
\/usr\/local\/src\/domain.tld.crt
\/usr\/local\/src\/domain.tld.ca<\/pre>\n\n\n\n4. Combine the Certificate and Intermediate CA<\/h3>\n\n\n\n
cd \/usr\/local\/src<\/pre>\n\n\n\n
cat domain.tld.crt domain.tld.ca > \/etc\/nginx\/ssl\/domain.tld.pem<\/pre>\n\n\n\n
5. Configure SSL Ciphers<\/h3>\n\n\n\n
vi \/etc\/nginx\/nginx.conf<\/pre>\n\n\n\n
ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;<\/pre>\n\n\n\n
\n
6. Configure the SSL Certificate for the Website<\/h3>\n\n\n\n
vi \/etc\/nginx\/sites-enabled\/default<\/pre>\n\n\n\n
server {
listen 443 ssl http2 default_server;
listen [::]:443 ssl http2 default_server;
root \/var\/www\/html;
ssl_certificate \/etc\/nginx\/ssl\/domain.tld.pem;
ssl_certificate_key \/etc\/nginx\/ssl\/domain.tld.key;
index index.php index.html index.htm;
server_name domain.tld www.domain.tld;
location \/ {
try_files $uri $uri\/ \/index.php?$args;
}
}
<\/pre>\n\n\n\n\n
domain.tld<\/code> \u2014 Replace with your actual domain.<\/li>\n\n\n\n\/var\/www\/html<\/code> \u2014 Replace with the actual website document root.<\/li>\n\n\n\n7. Check the Nginx Configuration<\/h3>\n\n\n\n
nginx -t<\/pre>\n\n\n\n
syntax is ok
test is successful<\/pre>\n\n\n\n8. Restart Nginx<\/h3>\n\n\n\n
systemctl restart nginx<\/pre>\n\n\n\n
systemctl status nginx<\/pre>\n\n\n\n
Verification<\/h2>\n\n\n\n
https:\/\/domain.tld<\/pre>\n\n\n\n
Conclusion<\/h2>\n\n\n\n
nginx -t<\/code> before restarting Nginx to avoid configuration-related service interruptions.<\/p>\n\n\n\nFAQs<\/h2>\n\n\n\n
1. What files are required to install an SSL certificate on Nginx?<\/h3>\n\n\n\n
2. Where should I store the SSL certificate and private key?<\/h3>\n\n\n\n
\/etc\/nginx\/ssl\/<\/pre>\n\n\n\n
3. Why do we combine the SSL certificate and intermediate CA?<\/h3>\n\n\n\n
4. How can I check whether the Nginx configuration is correct?<\/h3>\n\n\n\n
nginx -t<\/pre>\n\n\n\n
Related Article<\/h2>\n\n\n\n