SSL certificate installation in Nginx - Commands & Configuration

Introduction

Websites need to protect data sent between users and servers. Installing an SSL certificate makes the website secure by encrypting this data. This stops others from reading or changing the information.

When you want your website to show a secure padlock icon in browsers.

When you need to protect login pages or payment forms from hackers.

When you want to improve your website's trust and search engine ranking.

When you want to comply with security rules that require encrypted connections.

When you want to prevent warnings in browsers about unsafe websites.

Config File - nginx.conf

nginx.conf

server {
    listen 443 ssl;
    server_name example.com www.example.com;

    ssl_certificate /etc/nginx/ssl/example.com.crt;
    ssl_certificate_key /etc/nginx/ssl/example.com.key;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;

    location / {
        root /var/www/html;
        index index.html index.htm;
    }
}

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

This configuration sets up Nginx to use SSL on port 443 with your certificate and key files.

The ssl_certificate and ssl_certificate_key lines tell Nginx where to find your SSL files.

The ssl_protocols and ssl_ciphers lines ensure secure encryption methods.

The second server block listens on port 80 and redirects all traffic to HTTPS for security.

Commands

This command tests the Nginx configuration file for errors before applying changes.

Terminal

sudo nginx -t

Expected Output

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok

nginx: configuration file /etc/nginx/nginx.conf test is successful

This command reloads Nginx to apply the new SSL configuration without stopping the server.

Terminal

sudo systemctl reload nginx

Expected Output

No output (command runs silently)

This command checks the HTTP headers of your website over HTTPS to confirm SSL is working.

Terminal

curl -I https://example.com

Expected Output

HTTP/2 200 

server: nginx

content-type: text/html

...

→

-I - Fetch only HTTP headers to quickly check server response

Key Concept

If you remember nothing else from this pattern, remember: SSL certificates encrypt data between users and your server, and Nginx needs the certificate and key files configured to enable HTTPS.

Common Mistakes

Forgetting to test the Nginx configuration before reloading.

This can cause Nginx to fail to start if there are syntax errors, making your website unavailable.

Always run 'sudo nginx -t' to check for errors before reloading.

Using incorrect file paths for the SSL certificate or key in the config.

Nginx will not find the files and fail to start SSL, causing connection errors.

Double-check the paths to your .crt and .key files and ensure they are readable by Nginx.

Not redirecting HTTP traffic to HTTPS.

Users can still access the site insecurely, defeating the purpose of SSL.

Add a server block on port 80 that redirects all requests to HTTPS.

Summary

Configure Nginx with SSL certificate and key file paths in the server block listening on port 443.

Test the Nginx configuration with 'sudo nginx -t' to catch errors before applying.

Reload Nginx to apply changes without downtime using 'sudo systemctl reload nginx'.

Verify SSL is working by checking the website headers with 'curl -I https://example.com'.

Practice

1. What is the main purpose of installing an SSL certificate in nginx?

easy

A. To encrypt data between the user and the server

B. To speed up the website loading time

C. To block unwanted visitors

D. To increase server storage space

Solution

1. Step 1: Understand SSL certificate purpose

   SSL certificates encrypt data to keep communication secure between users and servers.

2. Step 2: Identify the correct purpose in nginx context

   In nginx, SSL certificates enable HTTPS, which encrypts data transfer.

3. Final Answer:

   To encrypt data between the user and the server -> Option A

4. Quick Check:

   SSL = encrypt data [OK]

Hint: SSL means secure data transfer over HTTPS [OK]

Common Mistakes:

• Thinking SSL speeds up website
• Confusing SSL with blocking visitors
• Assuming SSL increases storage

2. Which of the following is the correct nginx directive to specify the SSL certificate file?

easy

A. ssl_key /etc/nginx/cert.pem;

B. ssl_certificate_file /etc/nginx/cert.pem;

C. ssl_certificate /etc/nginx/cert.pem;

D. ssl_cert /etc/nginx/cert.pem;

Solution

1. Step 1: Recall nginx SSL certificate directive

   The correct directive to specify the SSL certificate file is ssl_certificate.

2. Step 2: Check options for syntax correctness

   Only ssl_certificate /etc/nginx/cert.pem; uses the exact directive ssl_certificate with correct syntax.

3. Final Answer:

   ssl_certificate /etc/nginx/cert.pem; -> Option C

4. Quick Check:

   ssl_certificate = correct directive [OK]

Hint: Use ssl_certificate for cert file path in nginx [OK]

Common Mistakes:

• Adding _file suffix to directive
• Using ssl_key for certificate file
• Misspelling ssl_certificate

3. Given this nginx server block snippet, what will happen when you restart nginx?

server {
    listen 443 ssl;
    ssl_certificate /etc/ssl/certs/mycert.pem;
    ssl_certificate_key /etc/ssl/private/mykey.pem;
}

medium

A. nginx will fail to start due to missing ssl_protocols directive

B. nginx will start listening on port 443 with SSL enabled

C. nginx will listen on port 80 instead of 443

D. nginx will start but SSL will be disabled

Solution

1. Step 1: Analyze the server block configuration

   The server listens on port 443 with SSL enabled using listen 443 ssl;. Certificate and key paths are provided.

2. Step 2: Understand nginx behavior on restart

   With valid certificate and key paths, nginx will start listening on port 443 with SSL enabled. The ssl_protocols directive is optional and defaults to secure protocols.

3. Final Answer:

   nginx will start listening on port 443 with SSL enabled -> Option B

4. Quick Check:

   listen 443 ssl + certs = SSL enabled [OK]

Hint: listen 443 ssl + certs means SSL active [OK]

Common Mistakes:

• Thinking ssl_protocols is mandatory
• Assuming nginx defaults to port 80
• Believing SSL disables without extra flags

4. You added SSL directives in nginx but get an error on restart: nginx: [emerg] PEM_read_bio_PrivateKey failed. What is the most likely cause?

medium

A. The private key file is missing or corrupted

B. The SSL certificate file path is incorrect

C. The listen directive is missing port 443

D. The ssl_certificate_key directive is misspelled

Solution

1. Step 1: Understand the error message

   The error PEM_read_bio_PrivateKey failed means nginx cannot read the private key file properly.

2. Step 2: Identify common causes

   This usually happens if the private key file is missing, corrupted, or has wrong permissions.

3. Final Answer:

   The private key file is missing or corrupted -> Option A

4. Quick Check:

   PEM_read_bio_PrivateKey error = private key issue [OK]

Hint: PEM_read_bio_PrivateKey error means private key problem [OK]

Common Mistakes:

• Blaming certificate file instead of key
• Ignoring file permissions
• Assuming listen directive causes this error

5. You want nginx to redirect all HTTP traffic to HTTPS after installing SSL. Which configuration snippet correctly achieves this?

hard

A. server {
listen 80 ssl;
ssl_certificate /etc/ssl/cert.pem;
ssl_certificate_key /etc/ssl/key.pem;
}

B. server {
listen 443 ssl;
return 301 http://$host$request_uri;
}

C. server {
listen 443;
return 301 http://$host$request_uri;
}

D. server {
listen 80;
return 301 https://$host$request_uri;
}

Solution

1. Step 1: Understand HTTP to HTTPS redirection

   To redirect HTTP (port 80) to HTTPS, nginx listens on port 80 and sends a 301 redirect to the HTTPS URL.

2. Step 2: Check each option for correctness

   server {
       listen 80;
       return 301 https://$host$request_uri;
   }

   listens on port 80 and returns a 301 redirect to https://$host$request_uri, which is correct. Other options either redirect HTTPS to HTTP or misuse SSL on port 80.

3. Final Answer:

   server { listen 80; return 301 https://$host$request_uri; } -> Option D

4. Quick Check:

   listen 80 + return 301 https = redirect HTTP to HTTPS [OK]

Hint: Redirect HTTP on port 80 to HTTPS with return 301 [OK]

Common Mistakes:

• Redirecting HTTPS to HTTP instead
• Adding SSL to port 80 listener
• Forgetting to use return 301 for redirect