SSL certificate installation in Nginx - Mini Project: Build & Apply

SSL Certificate Installation with Nginx

📖 Scenario: You are setting up a secure website using Nginx web server. To protect user data, you need to install an SSL certificate so that the website uses HTTPS instead of HTTP.This project will guide you step-by-step to configure Nginx to use SSL certificates correctly.

🎯 Goal: Configure Nginx to serve a website over HTTPS by installing SSL certificate files and updating the server block configuration.

📋 What You'll Learn

Create a basic Nginx server block configuration for HTTP

Add variables for SSL certificate and key file paths

Modify the server block to listen on port 443 with SSL enabled

Print the final Nginx server block configuration

💡 Why This Matters

🌍 Real World

Installing SSL certificates is essential to secure websites and protect user data during transmission. Nginx is a popular web server used in many real-world projects.

💼 Career

Understanding how to configure SSL in Nginx is a key skill for DevOps engineers, system administrators, and web developers working on secure web hosting.

1

Create a basic Nginx server block configuration

Create a variable called nginx_config and assign it a string containing a basic Nginx server block that listens on port 80 for the domain example.com and serves files from /var/www/html. Use the exact text below inside the string:

server {
    listen 80;
    server_name example.com;
    root /var/www/html;
}

Nginx

# Create the nginx_config variable with the basic server block
# Your code here

Hint

Use triple quotes or escape newlines with \n inside the string.

2

Add SSL certificate and key file path variables

Create two variables: ssl_certificate with the value "/etc/ssl/certs/example.com.crt" and ssl_certificate_key with the value "/etc/ssl/private/example.com.key".

Nginx

nginx_config = "server {\n    listen 80;\n    server_name example.com;\n    root /var/www/html;\n}"
# Create ssl_certificate and ssl_certificate_key variables
# Your code here

Hint

Assign the exact file paths as strings to the variables.

3

Update the Nginx config to enable SSL

Update the nginx_config variable to a new string that configures Nginx to listen on port 443 with SSL enabled for example.com. Include the lines listen 443 ssl;, ssl_certificate with the value of the ssl_certificate variable, and ssl_certificate_key with the value of the ssl_certificate_key variable. Keep the server_name and root lines unchanged. Use an f-string to insert the certificate paths.

Nginx

nginx_config = "server {\n    listen 80;\n    server_name example.com;\n    root /var/www/html;\n}"
ssl_certificate = "/etc/ssl/certs/example.com.crt"
ssl_certificate_key = "/etc/ssl/private/example.com.key"
# Update nginx_config to enable SSL using an f-string
# Your code here

Hint

Use an f-string to insert the ssl_certificate and ssl_certificate_key variables inside the config string.

4

Print the final Nginx configuration

Write a print statement to display the value of the nginx_config variable.

Nginx

ssl_certificate = "/etc/ssl/certs/example.com.crt"
ssl_certificate_key = "/etc/ssl/private/example.com.key"
nginx_config = f"server {{\n    listen 443 ssl;\n    server_name example.com;\n    root /var/www/html;\n    ssl_certificate {ssl_certificate};\n    ssl_certificate_key {ssl_certificate_key};\n}}"
# Print the nginx_config variable
# Your code here

Hint

Use print(nginx_config) to show the final configuration.

Practice

1. What is the main purpose of installing an SSL certificate in nginx?

easy

A. To encrypt data between the user and the server

B. To speed up the website loading time

C. To block unwanted visitors

D. To increase server storage space

Solution

1. Step 1: Understand SSL certificate purpose

   SSL certificates encrypt data to keep communication secure between users and servers.

2. Step 2: Identify the correct purpose in nginx context

   In nginx, SSL certificates enable HTTPS, which encrypts data transfer.

3. Final Answer:

   To encrypt data between the user and the server -> Option A

4. Quick Check:

   SSL = encrypt data [OK]

Hint: SSL means secure data transfer over HTTPS [OK]

Common Mistakes:

• Thinking SSL speeds up website
• Confusing SSL with blocking visitors
• Assuming SSL increases storage

2. Which of the following is the correct nginx directive to specify the SSL certificate file?

easy

A. ssl_key /etc/nginx/cert.pem;

B. ssl_certificate_file /etc/nginx/cert.pem;

C. ssl_certificate /etc/nginx/cert.pem;

D. ssl_cert /etc/nginx/cert.pem;

Solution

1. Step 1: Recall nginx SSL certificate directive

   The correct directive to specify the SSL certificate file is ssl_certificate.

2. Step 2: Check options for syntax correctness

   Only ssl_certificate /etc/nginx/cert.pem; uses the exact directive ssl_certificate with correct syntax.

3. Final Answer:

   ssl_certificate /etc/nginx/cert.pem; -> Option C

4. Quick Check:

   ssl_certificate = correct directive [OK]

Hint: Use ssl_certificate for cert file path in nginx [OK]

Common Mistakes:

• Adding _file suffix to directive
• Using ssl_key for certificate file
• Misspelling ssl_certificate

3. Given this nginx server block snippet, what will happen when you restart nginx?

server {
    listen 443 ssl;
    ssl_certificate /etc/ssl/certs/mycert.pem;
    ssl_certificate_key /etc/ssl/private/mykey.pem;
}

medium

A. nginx will fail to start due to missing ssl_protocols directive

B. nginx will start listening on port 443 with SSL enabled

C. nginx will listen on port 80 instead of 443

D. nginx will start but SSL will be disabled

Solution

1. Step 1: Analyze the server block configuration

   The server listens on port 443 with SSL enabled using listen 443 ssl;. Certificate and key paths are provided.

2. Step 2: Understand nginx behavior on restart

   With valid certificate and key paths, nginx will start listening on port 443 with SSL enabled. The ssl_protocols directive is optional and defaults to secure protocols.

3. Final Answer:

   nginx will start listening on port 443 with SSL enabled -> Option B

4. Quick Check:

   listen 443 ssl + certs = SSL enabled [OK]

Hint: listen 443 ssl + certs means SSL active [OK]

Common Mistakes:

• Thinking ssl_protocols is mandatory
• Assuming nginx defaults to port 80
• Believing SSL disables without extra flags

4. You added SSL directives in nginx but get an error on restart: nginx: [emerg] PEM_read_bio_PrivateKey failed. What is the most likely cause?

medium

A. The private key file is missing or corrupted

B. The SSL certificate file path is incorrect

C. The listen directive is missing port 443

D. The ssl_certificate_key directive is misspelled

Solution

1. Step 1: Understand the error message

   The error PEM_read_bio_PrivateKey failed means nginx cannot read the private key file properly.

2. Step 2: Identify common causes

   This usually happens if the private key file is missing, corrupted, or has wrong permissions.

3. Final Answer:

   The private key file is missing or corrupted -> Option A

4. Quick Check:

   PEM_read_bio_PrivateKey error = private key issue [OK]

Hint: PEM_read_bio_PrivateKey error means private key problem [OK]

Common Mistakes:

• Blaming certificate file instead of key
• Ignoring file permissions
• Assuming listen directive causes this error

5. You want nginx to redirect all HTTP traffic to HTTPS after installing SSL. Which configuration snippet correctly achieves this?

hard

A. server {
listen 80 ssl;
ssl_certificate /etc/ssl/cert.pem;
ssl_certificate_key /etc/ssl/key.pem;
}

B. server {
listen 443 ssl;
return 301 http://$host$request_uri;
}

C. server {
listen 443;
return 301 http://$host$request_uri;
}

D. server {
listen 80;
return 301 https://$host$request_uri;
}

Solution

1. Step 1: Understand HTTP to HTTPS redirection

   To redirect HTTP (port 80) to HTTPS, nginx listens on port 80 and sends a 301 redirect to the HTTPS URL.

2. Step 2: Check each option for correctness

   server {
       listen 80;
       return 301 https://$host$request_uri;
   }

   listens on port 80 and returns a 301 redirect to https://$host$request_uri, which is correct. Other options either redirect HTTPS to HTTP or misuse SSL on port 80.

3. Final Answer:

   server { listen 80; return 301 https://$host$request_uri; } -> Option D

4. Quick Check:

   listen 80 + return 301 https = redirect HTTP to HTTPS [OK]

Hint: Redirect HTTP on port 80 to HTTPS with return 301 [OK]

Common Mistakes:

• Redirecting HTTPS to HTTP instead
• Adding SSL to port 80 listener
• Forgetting to use return 301 for redirect