How to generate an SSL Certificate Signing Request for your Nginx Web Server with OpenSSL and install your SSL Certificate on your Nginx web server.

Actually I was surprised how easy it was to install SSL certificates for Nginx on Ubuntu.

I don’t remember if it was needed or not at this point or just when I was installing self signed SSL certificates for testing but, make sure you have the ssl-cert package installed:

admin@www1:~/sudo aptitude install ssl-cert openssl

Then make the CSR:

admin@www1:~/sudo openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr

This will start the process to generate two files: the Private-Key file for the decryption of your SSL Certificate, and a certificate signing request (CSR) file used to when ordering your SSL Certificate.

When you are prompted for the Common Name, which is your domain name, enter the fully qualified domain name for the site you are securing. Either www.afterdarkmike.com or afterdarkmike.com. Remember accessing the opposite of which you select via web browser will generate a miss-match domain security warning, with most browsers stopping you there.

If you are generating a Wildcard SSL Certificate for your Nginx server, make sure your common name starts with an asterisk (e.g. *.afterdarkmike.com).

Open the .csr file with a text editor (nano,vi,etc) and copy and paste it (including the BEGIN and END tags) into your SSL order form. Save the certificate files, you will need them later.

In my case I was purchasing a GeoTrust RapidSSL Certificate for a clients website we host and manage at After Dark Communications.

At the time of posting, your RapidSSL order will be shipped via an email which will include the SSL Certificate as well as the intermediate CA bundle. Copy them both into one file, including the —–BEGIN CERTIFICATE—– and —–END CERTIFICATE—– header/footers and save it as commonname.crt. ex afterdarkmike.com.crt.

So your file will look like:

-----BEGIN CERTIFICATE-----
Web Server CERTIFICATE blahblah blah blah blahblah blah
...
blahblah blah blah blahblah blah
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
INTERMEDIATE CA CERTIFICATE blahblah blah blah blahblah blah
...
blahblah blah blah blahblah blah
-----END CERTIFICATE-----

Upload it to the server.

Now to set up Nginx.

Edit the Nginx Virtual Hosts File:

server {
	listen 443;
	ssl on;
	<strong>ssl_certificate /etc/ssl/ssl.crt;</strong>
	<strong>ssl_certificate_key /etc/ssl/domain.key;</strong>
	server_name your.domain.com;
	access_log /var/log/nginx/nginx.vhost.access.log;
	error_log /var/log/nginx/nginx.vhost.error.log;
	location / {
		root /home/www/public_html/your.domain.com/public/;
		index index.html;
	}
}

Adjust the file names to match the certificate files and restart Nginx.