SSL directive configuration in Nginx - Commands & Configuration

Introduction

Websites need to protect data sent between users and servers. SSL directives in nginx help encrypt this data to keep it safe from hackers.

When you want to secure your website with HTTPS instead of HTTP.

When you have an SSL certificate and need to tell nginx where to find it.

When you want to redirect all visitors to use the secure HTTPS version of your site.

When you want to enable strong encryption settings for better security.

When you want to configure nginx to serve encrypted traffic on port 443.

Config File - nginx.conf

nginx.conf

server {
    listen 443 ssl;
    server_name example.com;

    ssl_certificate /etc/ssl/certs/example.com.crt;
    ssl_certificate_key /etc/ssl/private/example.com.key;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;

    location / {
        root /var/www/html;
        index index.html;
    }
}

server {
    listen 80;
    server_name example.com;
    return 301 https://$host$request_uri;
}

This configuration sets up nginx to listen on port 443 with SSL enabled.

ssl_certificate points to the public SSL certificate file.

ssl_certificate_key points to the private key file.

ssl_protocols defines which TLS versions are allowed.

ssl_ciphers sets the encryption algorithms to use.

The second server block listens on port 80 and redirects all traffic to HTTPS.

Commands

This command tests the nginx configuration file for syntax errors before restarting the server.

Terminal

sudo nginx -t

Expected Output

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok

nginx: configuration file /etc/nginx/nginx.conf test is successful

This command reloads nginx to apply the new SSL configuration without stopping the server.

Terminal

sudo systemctl reload nginx

Expected Output

No output (command runs silently)

This command checks the HTTP headers returned by the server to confirm HTTPS is working.

Terminal

curl -I https://example.com

Expected Output

HTTP/2 200 

server: nginx

content-type: text/html

...

→

-I - Fetch only HTTP headers without the body

Key Concept

If you remember nothing else from this pattern, remember: ssl_certificate and ssl_certificate_key must point to valid files and nginx must be reloaded after changes.

Common Mistakes

Using incorrect file paths for ssl_certificate or ssl_certificate_key.

Nginx will fail to start or reload because it cannot find the SSL files.

Double-check the full paths to your certificate and key files and ensure nginx has permission to read them.

Not testing nginx configuration before reloading.

Syntax errors can cause nginx to fail to reload, making your website unavailable.

Always run 'sudo nginx -t' to verify configuration before reloading.

Forgetting to redirect HTTP traffic to HTTPS.

Users can still access the insecure HTTP version, reducing security.

Add a server block listening on port 80 that redirects all requests to HTTPS.

Summary

Configure ssl_certificate and ssl_certificate_key in nginx to enable HTTPS.

Test the nginx configuration with 'nginx -t' before reloading.

Reload nginx to apply changes and verify HTTPS works with curl.

Practice

1. Which nginx directive is used to specify the SSL certificate file for HTTPS?

easy

A. ssl_key_certificate

B. ssl_key

C. ssl_cert_file

D. ssl_certificate

Solution

1. Step 1: Understand SSL certificate directive

   The directive to specify the SSL certificate file in nginx is ssl_certificate.

2. Step 2: Compare options with correct syntax

   Options B, C, and D are incorrect because they are not valid nginx directives for SSL certificate files.

3. Final Answer:

   ssl_certificate -> Option D

4. Quick Check:

   ssl_certificate = ssl_certificate [OK]

Hint: Remember: certificate file uses ssl_certificate directive [OK]

Common Mistakes:

• Confusing ssl_certificate_key with ssl_certificate
• Using incorrect directive names like ssl_key
• Mixing certificate and key directives

2. Which of the following is the correct syntax to enable SSL in an nginx server block?

easy

A. ssl on;

B. enable ssl;

C. ssl_enable on;

D. ssl active;

Solution

1. Step 1: Recall SSL enabling syntax in nginx

   In older nginx versions, SSL was enabled with ssl on; inside the server block.

2. Step 2: Validate options

   Options A, B, and D are not valid nginx directives or syntax for enabling SSL.

3. Final Answer:

   ssl on; -> Option A

4. Quick Check:

   ssl on; = ssl on; [OK]

Hint: Use 'ssl on;' to enable SSL in nginx server block [OK]

Common Mistakes:

• Using non-existent directives like enable ssl
• Confusing directive names
• Omitting the semicolon

3. Given this nginx SSL configuration snippet, what TLS versions are allowed?

ssl_protocols TLSv1.2 TLSv1.3;

medium

A. TLS 1.0, 1.1, 1.2, and 1.3 are allowed

B. Only TLS 1.2 and TLS 1.3 are allowed

C. Only TLS 1.3 is allowed

D. No TLS versions are allowed

Solution

1. Step 1: Read ssl_protocols directive

   The directive ssl_protocols TLSv1.2 TLSv1.3; explicitly allows only TLS version 1.2 and 1.3.

2. Step 2: Understand allowed TLS versions

   Older versions like TLS 1.0 and 1.1 are not included, so they are disallowed.

3. Final Answer:

   Only TLS 1.2 and TLS 1.3 are allowed -> Option B

4. Quick Check:

   ssl_protocols = TLSv1.2 and TLSv1.3 [OK]

Hint: ssl_protocols lists allowed TLS versions explicitly [OK]

Common Mistakes:

• Assuming all TLS versions are allowed by default
• Confusing ssl_protocols with ssl_ciphers
• Ignoring missing older TLS versions

4. Identify the error in this nginx SSL configuration snippet:

ssl_certificate /etc/nginx/certs/server.crt
ssl_certificate_key /etc/nginx/certs/server.key;

medium

A. Missing semicolon after ssl_certificate directive

B. Wrong file path for ssl_certificate_key

C. ssl_certificate_key directive is misspelled

D. ssl_certificate directive should not have a file path

Solution

1. Step 1: Check syntax for each directive

   Each nginx directive must end with a semicolon. The first line lacks a semicolon.

2. Step 2: Verify other parts

   The file paths and directive names are correct, only the missing semicolon causes a syntax error.

3. Final Answer:

   Missing semicolon after ssl_certificate directive -> Option A

4. Quick Check:

   Every directive ends with ; [OK]

Hint: Always end nginx directives with a semicolon [OK]

Common Mistakes:

• Forgetting semicolons at line ends
• Assuming file paths are incorrect without checking
• Misspelling directive names

5. You want to configure nginx to use a strong cipher suite and only TLS 1.3. Which configuration snippet achieves this securely?

hard

A. ssl_protocols TLSv1.2;
ssl_ciphers 'TLS_AES_128_GCM_SHA256';

B. ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers 'HIGH:!aNULL:!MD5';

C. ssl_protocols TLSv1.3;
ssl_ciphers 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256';

D. ssl_protocols TLSv1.3;
ssl_ciphers 'ALL';

Solution

1. Step 1: Select TLS version

   Only TLS 1.3 is allowed by ssl_protocols TLSv1.3;, matching the requirement.

2. Step 2: Choose strong cipher suites

   ssl_ciphers 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256'; uses strong TLS 1.3 ciphers explicitly. Other options either allow older TLS versions, use insecure cipher lists, or use generic 'ALL' which is insecure.

3. Final Answer:

   ssl_protocols TLSv1.3; ssl_ciphers 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256'; -> Option C

4. Quick Check:

   Only TLS 1.3 + strong ciphers = ssl_protocols TLSv1.3; ssl_ciphers 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256'; [OK]

Hint: Use ssl_protocols TLSv1.3 and specify strong TLS 1.3 ciphers [OK]

Common Mistakes:

• Allowing older TLS versions accidentally
• Using 'ALL' cipher which is insecure
• Mismatch between TLS version and cipher suite