Skip to main content

Install SSL Certificate on Nginx Server

By installing an SSL certificate on your Nginx server, you can enable HTTPS secure access for Nginx. This document describes how to install an SSL certificate on an Nginx server.

Note

This document takes Nginx version nginx/1.18.0 as an example. Before installation, confirm that port 443 is not occupied. If port 443 is already in use, bind another port when installing the certificate.

Obtain the Certificate​

  1. After we issue the certificate for you, you will receive the certificate file in .zip compressed format. The archive contains four folders corresponding to four certificate formats: Tomcat, Nginx, IIS, and Apache. For an Nginx server, you need to use the certificate in the Nginx folder.
  2. The Nginx folder contains two files:
  • domain_com_integrated.crt certificate file
  • domain_com.key private key file

Install the SSL Certificate​

  1. Copy the obtained domain_com_integrated.crt certificate file and domain_com.key private key file from your local directory to the /etc/nginx/ssl directory on the Nginx server.
  • If the /etc/nginx/ssl directory does not exist, you can create it using the mkdir -p /etc/nginx/ssl command.
  • The directory path may vary across different installation methods; please refer to your actual deployment.
  1. Edit the nginx.conf file located in the Nginx root directory. Modify the content as follows:
nginx.conf
server {
     listen 443 ssl; 
     #填写自己的域名，多个域名用空格隔开
     server_name racent.com; 					

     #填写证书文件的相对路径或绝对路径    
     ssl_certificate cloud.tencent.com_bundle.crt; 	

     #填写私钥文件的相对路径或绝对路径
     ssl_certificate_key cloud.tencent.com.key; 	
     ssl_session_timeout 5m;
     ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3; 
     ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4:!DH:!DHE; 
     ssl_prefer_server_ciphers on;
     location / {
         root /usr/share/nginx/html; 
         index  index.html index.htm;
     }
 }

Note

Due to version differences, there may be variations in how configuration files are written. For example, if your Nginx version is earlier than nginx/1.15.0, use listen 443 and ssl on instead of listen 443 ssl.

After making the modifications, save the configuration file and run the following command:

nginx -t         #验证配置文件是否正确
nginx -s reload  #重载 Nginx

Test the SSL certificate​

Enter the domain name bound to the SSL certificate in the browser's address bar to test whether your SSL certificate has been installed successfully. If the installation is successful, a security padlock icon will appear in the browser address bar; click it to view the certificate information.

SSL certificate effect

Security configuration for automatic HTTP to HTTPS redirect (optional)​

If you need to automatically redirect HTTP requests to HTTPS, you can configure it by following the steps below:

  1. Use Nginx's redirect function. Add return 301 https://$host$request_uri; to the HTTP server to redirect HTTP requests to HTTPS. Modify the content as follows:
server {
 listen 80;
 #把http的域名请求转成https
 return 301 https://$host$request_uri; 
}

  1. Restart the Nginx server, and you will be able to access the service via the domain name, achieving automatic redirection from HTTP to HTTPS.
Last updated on