This article assumes you've received your certificate from the Certificate Authority, and that you wish to install it on your Nginx webserver. If you want to know how to request a certificate, please consult the « How to generate a certificate request with OpenSSL » article.

Nginx - SSL certificate installation

Step 1: Building a certificate bundle

Unlike Apache, Nginx needs all its SSL certificates to be concatenated into one bundle containing the root certificate, the intermediate certificate and your own certificate. The order in which you concatenate the certificates is important:

• The first certificate in the file should be your own server certificate
• Then followed by intermediate certificate, if any - there usually is one, sometimes two
• Then followed by the root certificate

The root certificate is not strictly needed in this list, since browsers have CA's root certificates built-in, however it may be best practice to include it.

Depending on the Certificate Authority you ordered your certificate from, you may receive the certificates either as distinct files, all bundled in one file, or your certificate in one file and all CA certificates in a bundle. Most commonly, you will receive your own certificate as a separate file, and another file containing intermediate and root certificates for use in Apache.

If you have received separate files from the CA, use the following command to concatenate the certificates in reverse order. If there's only one intermediate certificate, you only need to concatenate that one, of course.

cat www.mydomain.com.crt intermediate_2.crt intermediate_1.crt CA_root.crt >> /etc/certs/bundle.crt

If you received your own certificate in a separate file, and the CA certificates in a bundle, execute the following command to create your bundle:

cat www.mydomain.com.crt ca-bundle.crt >> /etc/certs/bundle.crt

If you received all certificates in a single bundle, just move the file over to your certificate directory, for instance /etc/certs.

Step 2: Edit the Nginx virtual hosts file

Open the SSL virtual hosts file of your Nginx server. Depending on your distribution, it could be found at one of the following locations, or if you installed from source, somewhere entirely different (but then, you probably won't be needing this manual):

• /etc/nginx/conf.d/ssl.conf (Red Hat, CentOs and Fedora Linux)
• /etc/nginx/sites-available/www.mydomain.com (Debian and Ubuntu)

Add a new server block to the virtual hosts file. Note that in the example below, you should modify the paths so that they point to your website's root directory, and the SSL directives so they point to your SSL certificate and your private key. It may be easier to copy and modify an existing server entry in your config file.

server {
<strong> listen 443;
 ssl on;
 ssl_certificate /etc/certs/bundle.crt;
 ssl_certificate_key /etc/certs/www.mydomain.com.key;
</strong> <strong>ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
</strong> <strong>ssl_prefer_server_ciphers on;</strong>

 server_name www.mydomain.com;
 access_log /var/log/nginx/nginx.vhost.access.log;
 error_log /var/log/nginx/nginx.vhost.error.log;
 location / {
 root /home/www/public_html/www.mydomain.com/public/;
 index index.html;
 }
}

Please note that the above is only a minimal working server configuration, and that your web server should be tuned for optimum security and performance. You may want to check out our articles on tuning and securing Nginx in the Knowledge Base.

Step 3: Test your configuration

It's good practice to check your server configuration before restarting Nginx. Modify the command below to point to your main Nginx configuration file if it's in a different location.

nginx -t -c /etc/nginx/nginx.conf

Step 4: Restart Nginx

Restart Nginx to apply your new configuration:

/etc/init.d/nginx restart

Step 5: Troubleshooting

If you didn't concatenate your certificates in the correct order, Nginx will fail to start and display an error similar to the following one:

SSL_CTX_use_PrivateKey_file(" ... /www.mydomain.com.key") failed
 (SSL: error:0B080074:x509 certificate routines: X509_check_private_key:key values mismatch)

In that case, try to concatenate your certificate files in the correct order again.

If your certificate doesn't display correctly in a browser, check if all certificates are being sent correctly to a browser with the following command, replacing www.kinamo.be with your own domain name:

openssl s_client -connect www.kinamo.be:443
...
Certificate chain
 0 s:/1.3.6.1.4.1.311.60.2.1.3=BE/businessCategory=Private Organization/serialNumber=0861.077.215/C=BE/ST=Antwerpen/L=antwerpen/O=Kinamo NV/CN=www.kinamo.be
 i:/C=US/O=GeoTrust Inc./CN=GeoTrust Extended Validation SSL CA - G2
 1 s:/C=US/O=GeoTrust Inc./CN=GeoTrust Extended Validation SSL CA - G2
 i:/C=US/O=GeoTrust Inc./CN=GeoTrust Primary Certification Authority

You should see a chain of certificates starting with your own one, and going up through the different intermediate certificates.

Step 6: Security Test

Visit Qualys SSL Labs' test page to check if your web server and SSL certificate are up to par with modern-day security standards.