How to Install SSL on nginx

1. Install certbot + plugin: apt install certbot python3-certbot-nginx
2. Ensure the domain resolves to the server (A record)
3. Auto-install: certbot --nginx -d example.com -d www.example.com
4. Certbot will ask about HTTP→HTTPS redirect (always yes)
5. Verify: curl -I https://example.com → HTTP/1.1 200 OK
6. Enable auto-renew: systemctl enable --now certbot.timer
7. Test: Enterno SSL → grade A+ with proper cipher suite

• Using only cert.pem (no intermediate) → ERR_CERT_AUTHORITY_INVALID for clients
• Missing OCSP Stapling → -10 points in Qualys SSL Labs grade
• Weak ciphers (RC4, 3DES) → grade F + Chrome ERR_SSL_VERSION_OR_CIPHER_MISMATCH
• HSTS without testing — if something breaks, clients are locked out for weeks
• Port 80 closed by firewall — certbot renewal fails (HTTP-01 challenge)

To install an SSL certificate on Nginx, obtain your certificate files, then modify the Nginx configuration file to include the paths to your SSL certificate and private key. Use the listen 443 ssl; directive to enable SSL, and test the configuration before reloading Nginx. This ensures secure HTTPS connections for your website.

Installing an SSL certificate on Nginx involves several specific steps to ensure your server is correctly configured for secure connections. Below, we provide a detailed walkthrough of these steps, including practical commands and configurations.

Prerequisites

Before you start, ensure that you have:

• Access to your Nginx server (root or sudo privileges).
• An SSL certificate and its corresponding private key. You can obtain these from a Certificate Authority (CA) or generate a self-signed certificate for testing purposes.
• The Nginx web server installed and running on your server.

Step 1: Obtain Your SSL Certificate

If you haven't already obtained an SSL certificate, you can purchase one from a trusted CA like Let's Encrypt, DigiCert, or Comodo. If you're testing, you can create a self-signed certificate with the following commands:

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/mydomain.key -out /etc/ssl/certs/mydomain.crt

This command generates a private key and a self-signed certificate valid for one year.

Step 2: Configure Nginx for SSL

Next, you need to configure Nginx to use your SSL certificate. Open the Nginx configuration file for your site, typically located at /etc/nginx/sites-available/default or a similar path depending on your setup:

sudo nano /etc/nginx/sites-available/default

In the server block, add the following lines:

server {
    listen 443 ssl;
    server_name mydomain.com www.mydomain.com;
    ssl_certificate /etc/ssl/certs/mydomain.crt;
    ssl_certificate_key /etc/ssl/private/mydomain.key;
    location / {
        try_files $uri $uri/ =404;
    }
}

Replace mydomain.com with your actual domain name, and ensure the paths to your certificate and key files are correct.

Step 3: Redirect HTTP Traffic to HTTPS

For better security, it’s advisable to redirect all HTTP traffic to HTTPS. You can add another server block to your configuration file:

server {
    listen 80;
    server_name mydomain.com www.mydomain.com;
    return 301 https://$host$request_uri;
}

This configuration listens on port 80 and redirects any requests to the equivalent HTTPS URL.

Step 4: Test Your Configuration

Before reloading Nginx, check your configuration for syntax errors:

sudo nginx -t

If the test is successful, you will see a message indicating the configuration is okay. If there are errors, fix them as indicated.

Step 5: Reload Nginx

Once your configuration is error-free, reload Nginx to apply the changes:

sudo systemctl reload nginx

Step 6: Verify SSL Installation

To confirm that your SSL certificate is installed correctly, you can use tools like SSL Labs' SSL Test (ssllabs.com) or simply navigate to your website using https://. Look for the padlock symbol in the browser's address bar, indicating a secure connection.

Conclusion

By following these steps, you can successfully install an SSL certificate on your Nginx server, enhancing the security of your website and ensuring encrypted connections for your users. Regularly check your SSL certificate's validity and renew it as needed to maintain secure communications.