SSL certificate installation in Nginx - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

Check SSL certificate expiration date

You run this command to check the expiration date of an SSL certificate for example.com:

openssl s_client -connect example.com:443 -servername example.com < /dev/null | openssl x509 -noout -dates

What is the expected output format?

Nginx

openssl s_client -connect example.com:443 -servername example.com < /dev/null | openssl x509 -noout -dates

A Error: unable to load certificate

B Certificate expires on 2024-08-30

C Expiration date: 08/30/2024

D notBefore=Jun 1 12:00:00 2024 GMT\nnotAfter=Aug 30 12:00:00 2024 GMT

💡 Hint

The command outputs two lines starting with notBefore and notAfter.

The openssl x509 -noout -dates command outputs the certificate validity period with 'notBefore' and 'notAfter' lines in a fixed format.

❓ Configuration

intermediate

Nginx SSL configuration snippet

Which of the following nginx server block snippets correctly enables SSL using the certificate files located at /etc/ssl/certs/example.crt and /etc/ssl/private/example.key?

A

listen 443 ssl;
ssl_certificate_key /etc/ssl/private/example.key;
ssl_certificate /etc/ssl/certs/example.crt;

B

listen 443;
ssl on;
ssl_certificate /etc/ssl/certs/example.crt;
ssl_certificate_key /etc/ssl/private/example.key;

C

listen 443 ssl;
ssl_certificate /etc/ssl/certs/example.crt;
ssl_certificate_key /etc/ssl/private/example.key;

D

listen 443 ssl;
ssl_certificate /etc/ssl/private/example.key;
ssl_certificate_key /etc/ssl/certs/example.crt;

💡 Hint

The ssl_certificate directive must point to the certificate file, and ssl_certificate_key to the private key.

The correct order is ssl_certificate for the public certificate and ssl_certificate_key for the private key. The listen directive must include ssl.

❓ Troubleshoot

advanced

Nginx fails to start after SSL config change

After adding SSL configuration to your nginx server block, nginx fails to start with the error:

nginx: [emerg] PEM_read_bio_PrivateKey("/etc/ssl/private/example.key") failed

What is the most likely cause?

A The private key file is missing or has incorrect permissions.

B The SSL protocol version is not specified.

C The nginx user does not have permission to read the certificate file.

D The certificate file is expired.

💡 Hint

The error mentions PEM_read_bio_PrivateKey failure.

This error usually means nginx cannot read the private key file due to missing file or permission issues.

🔀 Workflow

advanced

Order of steps to install SSL certificate on nginx

What is the correct order of steps to install a new SSL certificate on an nginx server?

A 1,3,2,4

B 1,2,3,4

C 2,1,3,4

D 3,1,2,4

💡 Hint

You must have the files before configuring nginx.

First get the files, then update config, test syntax, and finally reload nginx.

✅ Best Practice

expert

Secure SSL configuration for nginx

Which nginx SSL configuration snippet follows best security practices to enable strong encryption and prevent known vulnerabilities?

A

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';
ssl_prefer_server_ciphers on;

B

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;

C

ssl_protocols SSLv3 TLSv1.2;
ssl_ciphers ALL;
ssl_prefer_server_ciphers off;

D

ssl_protocols TLSv1.2;
ssl_ciphers LOW:MEDIUM;
ssl_prefer_server_ciphers off;

💡 Hint

Use only modern TLS versions and strong ciphers.

Best practice is to enable only TLS 1.2 and 1.3, use strong ciphers, and prefer server ciphers.