All posts
Developer

A Step-by-Step Guide to Configuring SSL/TLS on Nginx

October 17, 20265 min read

Introduction

Configuring SSL/TLS on Nginx is an essential step in securing your web application and protecting sensitive data. In this guide, we will walk you through a step-by-step process of configuring SSL/TLS on Nginx, covering the necessary prerequisites, obtaining a certificate, creating a certificate signing request (CSR), installing the certificate, and configuring Nginx to use the certificate.

Prerequisites

Before you begin, ensure that you have the following:
  • A domain name registered with a registrar (e.g., GoDaddy, Namecheap)
  • A hosting provider that supports Nginx (e.g., AWS, DigitalOcean, Linode)
  • OpenSSL installed on your system (most Linux distributions come with OpenSSL pre-installed)
  • A text editor or IDE of your choice

Obtaining a Certificate

To obtain a certificate, you will need to generate a certificate signing request (CSR) and obtain a certificate from a trusted Certificate Authority (CA). There are several ways to obtain a certificate, including:
  • Let's Encrypt: a free, automated, and open certificate authority
  • GlobalSign: a paid certificate authority offering various types of certificates
  • Comodo: a paid certificate authority offering various types of certificates

For this guide, we will use Let's Encrypt.

Generating a Certificate Signing Request (CSR)

To generate a CSR, follow these steps:
  • Open a terminal or command prompt
  • Run the following command to generate a new private key: openssl genrsa -out /path/to/your/private/key.pem 2048
  • Run the following command to generate a CSR: openssl req -new -key /path/to/your/private/key.pem -out /path/to/your/csr.pem -subj "/C=US/ST=State/L=Locality/O=Organization/CN=yourdomain.com"

Replace /path/to/your/private/key.pem with the path to your private key, /path/to/your/csr.pem with the path to your CSR, and yourdomain.com with your domain name.

Obtaining a Certificate from Let's Encrypt

To obtain a certificate from Let's Encrypt, you will need to use the `certbot` tool. You can install `certbot` using your package manager or download it from the official Let's Encrypt website.

Once installed, run the following command to obtain a certificate:

  • sudo certbot certonly --webroot --webroot-path=/path/to/your/webroot -d yourdomain.com

Replace /path/to/your/webroot with the path to your webroot directory and yourdomain.com with your domain name.

Installing the Certificate

Once you have obtained a certificate, you will need to install it on your server. You can do this by copying the certificate files to the following locations:
  • /etc/ssl/certs/yourdomain.com.crt (the certificate file)
  • /etc/ssl/private/yourdomain.com.key (the private key file)

Creating a Certificate Bundle

To create a certificate bundle, you will need to combine the certificate and private key into a single file. You can do this using the following command:
  • cat /etc/ssl/certs/yourdomain.com.crt /etc/ssl/private/yourdomain.com.key > /etc/ssl/certs/yourdomain.com.bundle

Replace /etc/ssl/certs/yourdomain.com.crt and /etc/ssl/private/yourdomain.com.key with the paths to your certificate and private key files, and /etc/ssl/certs/yourdomain.com.bundle with the path to your certificate bundle file.

Configuring Nginx to Use the Certificate

To configure Nginx to use the certificate, you will need to modify the Nginx configuration file. You can do this by adding the following lines to your Nginx configuration file:
  • server {
  • listen 443 ssl;
  • ssl_certificate /etc/ssl/certs/yourdomain.com.crt;
  • ssl_certificate_key /etc/ssl/private/yourdomain.com.key;
  • server_name yourdomain.com;
  • ...
  • }

Replace /etc/ssl/certs/yourdomain.com.crt and /etc/ssl/private/yourdomain.com.key with the paths to your certificate and private key files, and yourdomain.com with your domain name.

Restarting Nginx

Once you have modified the Nginx configuration file, you will need to restart Nginx to apply the changes. You can do this by running the following command:
  • sudo service nginx restart

Testing the Certificate

To test the certificate, you can use the following tools:
  • openssl s_client -connect yourdomain.com:443
  • openssl s_client -connect yourdomain.com:443 -servername yourdomain.com

Replace yourdomain.com with your domain name.

Conclusion

Configuring SSL/TLS on Nginx is an essential step in securing your web application and protecting sensitive data. By following this guide, you should be able to obtain a certificate, install it on your server, and configure Nginx to use the certificate.

Best Practices

To ensure the security of your web application, follow these best practices:
  • Use a trusted Certificate Authority (CA) to obtain a certificate
  • Use a secure protocol (HTTPS) for all communication between your web application and clients
  • Regularly update and patch your Nginx installation to ensure the latest security fixes are applied
  • Use a Web Application Firewall (WAF) to protect your web application from common web attacks
  • Monitor your web application's security regularly to detect and respond to potential security threats