SSL certificate installation in Nginx - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

Check SSL certificate expiration date

You run this command to check the expiration date of an SSL certificate for example.com:

openssl s_client -connect example.com:443 -servername example.com < /dev/null | openssl x509 -noout -dates

What is the expected output format?

Nginx

openssl s_client -connect example.com:443 -servername example.com < /dev/null | openssl x509 -noout -dates

A Error: unable to load certificate

B Certificate expires on 2024-08-30

C Expiration date: 08/30/2024

D notBefore=Jun 1 12:00:00 2024 GMT\nnotAfter=Aug 30 12:00:00 2024 GMT

💡 Hint

The command outputs two lines starting with notBefore and notAfter.

The openssl x509 -noout -dates command outputs the certificate validity period with 'notBefore' and 'notAfter' lines in a fixed format.

❓ Configuration

intermediate

Nginx SSL configuration snippet

Which of the following nginx server block snippets correctly enables SSL using the certificate files located at /etc/ssl/certs/example.crt and /etc/ssl/private/example.key?

A

listen 443 ssl;
ssl_certificate_key /etc/ssl/private/example.key;
ssl_certificate /etc/ssl/certs/example.crt;

B

listen 443;
ssl on;
ssl_certificate /etc/ssl/certs/example.crt;
ssl_certificate_key /etc/ssl/private/example.key;

C

listen 443 ssl;
ssl_certificate /etc/ssl/certs/example.crt;
ssl_certificate_key /etc/ssl/private/example.key;

D

listen 443 ssl;
ssl_certificate /etc/ssl/private/example.key;
ssl_certificate_key /etc/ssl/certs/example.crt;

💡 Hint

The ssl_certificate directive must point to the certificate file, and ssl_certificate_key to the private key.

The correct order is ssl_certificate for the public certificate and ssl_certificate_key for the private key. The listen directive must include ssl.

❓ Troubleshoot

advanced

Nginx fails to start after SSL config change

After adding SSL configuration to your nginx server block, nginx fails to start with the error:

nginx: [emerg] PEM_read_bio_PrivateKey("/etc/ssl/private/example.key") failed

What is the most likely cause?

A The private key file is missing or has incorrect permissions.

B The SSL protocol version is not specified.

C The nginx user does not have permission to read the certificate file.

D The certificate file is expired.

💡 Hint

The error mentions PEM_read_bio_PrivateKey failure.

This error usually means nginx cannot read the private key file due to missing file or permission issues.

🔀 Workflow

advanced

Order of steps to install SSL certificate on nginx

What is the correct order of steps to install a new SSL certificate on an nginx server?

A 1,3,2,4

B 1,2,3,4

C 2,1,3,4

D 3,1,2,4

💡 Hint

You must have the files before configuring nginx.

First get the files, then update config, test syntax, and finally reload nginx.

✅ Best Practice

expert

Secure SSL configuration for nginx

Which nginx SSL configuration snippet follows best security practices to enable strong encryption and prevent known vulnerabilities?

A

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';
ssl_prefer_server_ciphers on;

B

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;

C

ssl_protocols SSLv3 TLSv1.2;
ssl_ciphers ALL;
ssl_prefer_server_ciphers off;

D

ssl_protocols TLSv1.2;
ssl_ciphers LOW:MEDIUM;
ssl_prefer_server_ciphers off;

💡 Hint

Use only modern TLS versions and strong ciphers.

Best practice is to enable only TLS 1.2 and 1.3, use strong ciphers, and prefer server ciphers.

Practice

1. What is the main purpose of installing an SSL certificate in nginx?

easy

A. To encrypt data between the user and the server

B. To speed up the website loading time

C. To block unwanted visitors

D. To increase server storage space

Solution

1. Step 1: Understand SSL certificate purpose

   SSL certificates encrypt data to keep communication secure between users and servers.

2. Step 2: Identify the correct purpose in nginx context

   In nginx, SSL certificates enable HTTPS, which encrypts data transfer.

3. Final Answer:

   To encrypt data between the user and the server -> Option A

4. Quick Check:

   SSL = encrypt data [OK]

Hint: SSL means secure data transfer over HTTPS [OK]

Common Mistakes:

• Thinking SSL speeds up website
• Confusing SSL with blocking visitors
• Assuming SSL increases storage

2. Which of the following is the correct nginx directive to specify the SSL certificate file?

easy

A. ssl_key /etc/nginx/cert.pem;

B. ssl_certificate_file /etc/nginx/cert.pem;

C. ssl_certificate /etc/nginx/cert.pem;

D. ssl_cert /etc/nginx/cert.pem;

Solution

1. Step 1: Recall nginx SSL certificate directive

   The correct directive to specify the SSL certificate file is ssl_certificate.

2. Step 2: Check options for syntax correctness

   Only ssl_certificate /etc/nginx/cert.pem; uses the exact directive ssl_certificate with correct syntax.

3. Final Answer:

   ssl_certificate /etc/nginx/cert.pem; -> Option C

4. Quick Check:

   ssl_certificate = correct directive [OK]

Hint: Use ssl_certificate for cert file path in nginx [OK]

Common Mistakes:

• Adding _file suffix to directive
• Using ssl_key for certificate file
• Misspelling ssl_certificate

3. Given this nginx server block snippet, what will happen when you restart nginx?

server {
    listen 443 ssl;
    ssl_certificate /etc/ssl/certs/mycert.pem;
    ssl_certificate_key /etc/ssl/private/mykey.pem;
}

medium

A. nginx will fail to start due to missing ssl_protocols directive

B. nginx will start listening on port 443 with SSL enabled

C. nginx will listen on port 80 instead of 443

D. nginx will start but SSL will be disabled

Solution

1. Step 1: Analyze the server block configuration

   The server listens on port 443 with SSL enabled using listen 443 ssl;. Certificate and key paths are provided.

2. Step 2: Understand nginx behavior on restart

   With valid certificate and key paths, nginx will start listening on port 443 with SSL enabled. The ssl_protocols directive is optional and defaults to secure protocols.

3. Final Answer:

   nginx will start listening on port 443 with SSL enabled -> Option B

4. Quick Check:

   listen 443 ssl + certs = SSL enabled [OK]

Hint: listen 443 ssl + certs means SSL active [OK]

Common Mistakes:

• Thinking ssl_protocols is mandatory
• Assuming nginx defaults to port 80
• Believing SSL disables without extra flags

4. You added SSL directives in nginx but get an error on restart: nginx: [emerg] PEM_read_bio_PrivateKey failed. What is the most likely cause?

medium

A. The private key file is missing or corrupted

B. The SSL certificate file path is incorrect

C. The listen directive is missing port 443

D. The ssl_certificate_key directive is misspelled

Solution

1. Step 1: Understand the error message

   The error PEM_read_bio_PrivateKey failed means nginx cannot read the private key file properly.

2. Step 2: Identify common causes

   This usually happens if the private key file is missing, corrupted, or has wrong permissions.

3. Final Answer:

   The private key file is missing or corrupted -> Option A

4. Quick Check:

   PEM_read_bio_PrivateKey error = private key issue [OK]

Hint: PEM_read_bio_PrivateKey error means private key problem [OK]

Common Mistakes:

• Blaming certificate file instead of key
• Ignoring file permissions
• Assuming listen directive causes this error

5. You want nginx to redirect all HTTP traffic to HTTPS after installing SSL. Which configuration snippet correctly achieves this?

hard

A. server {
listen 80 ssl;
ssl_certificate /etc/ssl/cert.pem;
ssl_certificate_key /etc/ssl/key.pem;
}

B. server {
listen 443 ssl;
return 301 http://$host$request_uri;
}

C. server {
listen 443;
return 301 http://$host$request_uri;
}

D. server {
listen 80;
return 301 https://$host$request_uri;
}

Solution

1. Step 1: Understand HTTP to HTTPS redirection

   To redirect HTTP (port 80) to HTTPS, nginx listens on port 80 and sends a 301 redirect to the HTTPS URL.

2. Step 2: Check each option for correctness

   server {
       listen 80;
       return 301 https://$host$request_uri;
   }

   listens on port 80 and returns a 301 redirect to https://$host$request_uri, which is correct. Other options either redirect HTTPS to HTTP or misuse SSL on port 80.

3. Final Answer:

   server { listen 80; return 301 https://$host$request_uri; } -> Option D

4. Quick Check:

   listen 80 + return 301 https = redirect HTTP to HTTPS [OK]

Hint: Redirect HTTP on port 80 to HTTPS with return 301 [OK]

Common Mistakes:

• Redirecting HTTPS to HTTP instead
• Adding SSL to port 80 listener
• Forgetting to use return 301 for redirect