Making NGINX Server HTTPS Certified
For making a server HTTPS compatible, these steps can be followed if you are purchasing the SSL certificate from Godaddy:
- Purchase an SSL certificate from Godaddy.
- Now login to your server using SSH
ssh -i pemkeypath user@serverip
- Generate a private key and CSR file using openssl
openssl req -newkey rsa:2048 -nodes -keyout yourdomain.com.key -out yourdomain.com.csr
#Change the yourdomain.com with your domain name
- Go to Godaddy and select your SSL certificate and click on setup and do as asked
- Now when asked paste the already generated CSR file and click on apply
- Now the verification process will start and from now follow the godaddy guidelines as they will prompt step by step, what is required next.
- For domain verification they may sent an HTML file that needs to be placed in server root folder and check whether it is opening appropriately as asked
- If not visible, change the permission of the file as public and reload again
- Again follow the instructions of Godaddy.
- Once the verification process is complete, you will get a zipped file to download. If you are using nginx or apache select apache and then download.
- Now once you extract the file, you will receive two .crt files :
a. your SSL certificate which would have a random name
b. Godaddy intermediate certificate bundle gd_bundle-g2-1.crt
- Rename your ssl certificate to your domain name i.e. yourdomain.com.crt and intermediate certificate to intermediate.crt
- Upload both the certificates to a secure location on server.
- For nginx you need to build a chained certificate by merging both the certificate files into on as:
cat yourdomain.com.crt intermediate.crt > yourdomain.com.chained.crt
- Modify the listen directive in your nginx config file
listen 443 ssl;
- Now change the server_name directive and add the paths of ssl chained certificate and ssl certificate key
server_name yourdomain.com;
ssl_certificate /home/sammy/yourdomain.com.chained.crt;
ssl_certificate_key /home/sammy/yourdomain.com.key;
- Change the protocols and ciphers
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers AES256+EECDH:AES256+EDH:!aNULL;
- For redirecting all the http calls to https add the following lines in http section
server {
listen 80;
server_name yourdomain.com;
rewrite ^/(.*) https://yourdomain.com/$1 permanent;
}
- Now restart your server and your server is https now.
For more blogs like this click here
0 Comment(s)