How to Install an SSL Certificate on NGINX Ubuntu Manually or Automatically 

Easily secure your website on NGINX (Ubuntu) with an SSL (TLS) certificate. Follow our beginner-friendly step-by-step guide to installing HTTPS using OpenSSL or GeoTrust Horizon’s AutoInstall SSL feature. 

If you’re running a website on an NGINX server using the Ubuntu distro, enabling HTTPS is critical for both security and SEO. (HTTPS is viewed by Google Search as a positive page experience factor.) In this step-by-step guide, we’ll show you two methods to install an SSL certificate on NGINX Ubuntu:  

1. The manual method of using OpenSSL and a Comodo SSL/TLS certificate, and  
2. Using GeoTrust Horizon’s AutoInstall SSL automation agent.  

Whether you’re setting up a new site or securing an existing one, this article will walk you through the process step-by-step.  

Prerequisite: You Must Have an SSL Certificate  

To install SSL on your Ubuntu server, you’ll need a valid SSL certificate. We recommend choosing a GeoTrust SSL Certificate for trusted encryption, compatibility, and flexible options to suit different needs. (You can purchase an SSL/TLS certificate easily through your GeoTrust Horizon user account dashboard.)  

Manual Method: A Step-By-Step Guide to Installing SSL on NGINX 

This section will show you how to install and configure an SSL/TLS certificate manually on your NGINX server.   

Step 1: Generate & Submit a Certificate Signing Request (CSR) 

Before you can install an SSL certificate on NGINX, you’ll first need to generate a CSR. To do this on your Ubuntu server using OpenSSL, use a customized version of the following command: 

openssl req -new -newkey rsa:2048 -nodes -keyout your_domain_tld.key -out your_domain.tld.csr 

Replace the generic key and CSR file names with your domain and key information: 

You’ll be asked to supply a variety of other information about your organization, such as its common name, organizational information, and specific location-related details.

This will generate your CSR, which is a long string of base-64 characters that looks similar to this example: 

For this next part, we’ll assume you’ve already purchased an SSL/TLS certificate from GeoTrust.com. To complete the certificate signing request process: 

• Go to the GeoTrust Horizon dashboard, navigate to All Orders, and locate your certificate order. (If you just purchased your certificate moments ago, just hit the Generate Certificate on the Next Steps screen after completing your order.)

• Click the Generate Certificate option in the Order ID row. 
• On the next screen, you’ll be asked to enter or select the domain associated with the certificate.
• After that, you must select either automated SSL/TLS installation (using AutoInstall SSL, which we’ll speak to in the next main section) or the manual installation method. Select the manual method and hit Continue.
• In the CSR submission field, paste the entire content of your CSR file as is — including the header and footer lines. (Be sure to remove any extra spaces and verify no lines are missing): 

-----BEGIN CERTIFICATE REQUEST-----  

[your encoded CSR content] 

-----END CERTIFICATE REQUEST-----

• At the bottom of the page, review the terms and conditions before hitting Continue. 

Specify your chosen domain validation method. We’ll use HTTP file-based validation for this example. (This method is recommended for all domain validations with the exception of wildcard SSL certificates, which can’t use file-based validation.) 

Provide the requisite technical contact details and submit your signing request.

Step 2: Complete the Validation Process 

Press the Start Validation button to begin the validation process.

On the next screen, hit the Download File button to collect the specified text file from the GeoTrust Horizon dashboard. You’ll SSH into your server and upload this file to the specified file path. (For example: /var/www/html/.well-known/pki-validation/<provided_by_your_certificate_provider>.txt.) 

If cPanel and NGINX Are on the Same Server

If your situation is one of the rare ones that has cPanel and NGINX connected to the same server, then you can use either option to upload your CA’s validation file.

Check if the test file is accessible at https://<your_domain>/.well-known/pki-validation/ <validation_filename>.txt, as shown in the example below: 

If cPanel and NGINX Are Not on the Same Server

In this case, you must manually upload your certificate in the NGINX terminal.

Run the following command and follow the subsequent steps to save the authentication file to your NGINX Ubuntu server:

mkdir -p/var/www/html/.well-known/pki-validation
nano /var/www/html/.well-known/pki-validation/validation_file.txt

• Paste the contents of the CA’s .txt file
• Save it by pressing CTRL + X
• Select Y and hit Enter to finish

Back in GeoTrust Horizon, verify your validation files are in place:

• Wait about five minutes before hitting the Validation Pending Refresh option at the top of the Certificate Validation Process section.
• Click Request Verification. Do you see a message stating that the “certificate is pending validation”? Then check out our troubleshooting guide. 

NOTE: You’ll be required to provide additional validation-related information for organization validation (OV) and extended validation (EV) certificates. 

Step 3: Download and Install the SSL/TLS Certificate on NGINX Ubuntu 

Once the CA has successfully validated your domain (and any other relevant organization information for higher-validation certificates), it issues the SSL certificate. You can download the ZIP file for your certificate from the GeoTrust Horizon dashboard, as shown below:  

Unzip the file folder, which will contain at least these two files: 

• your domain’s certificate
• the CA’s intermediate certificate (e.g., ca_bundle.ca-bundle)   

Next, concatenate (bundle) those certificates into a single file using this command:

cat domain_name_tld.crt ca_bundle.ca-bundle > output_bundle.pem

Alternatively, you could also save it as a .crt file instead:

cat domain_name.crt ca_bundle.ca-bundle > output_bundle.crt

Upload Your Server Certificate and CA Bundle Files 

Run scp to securely copy your bundle file from the local machine to the NGINX server. This step may require pushing the key up, too (which we show how to do in the following command). However, in this case, the key is on the server already because it was generated when we created the CSR earlier, so we don’t have to move it.

scp -i <domain_name_tld.key> .\output_bundle.pem .\domain_name_tld.key <username>@nginx<ip_address>:/home/<username>

NOTE: Replace the placeholder certificate name and other info with your custom values accordingly.

Next, if you need to, move the files to the right directory (e.g., moving to /etc/ssl/certs for the bundle file and /etc/ssl/private for they key):

sudo mv /home/<username>/output-bundle.pem /new/file/path
sudo mv /home<username>/domain_name.key /new/file/path

Set File Permissions

It’s time to set restricted permissions so only the owner has access to the key, and the owner + groups + others have access to the bundle file. (Note the following permission values: 6 = read + write for the owner, 4 = read-only for group, and 4= specifies read-only for others.)

Be sure to replace the placeholder values in the following command with your details: 

sudo chmod 600 /your/directory/path/domain_name_tld.key 
sudo chmod 644 /your/directory/path/output_bundle.pem

Step 4. Configure NGINX to Use the Secure HTTPS Protocol

Open your NGINX server blog configuration (typically found at /etc/nginx/sites-available/your_domain) to ensure that it’s set to listen on port 443, redirecting HTTP to HTTPS, and that it uses SSL: 

server { 

    listen 443 ssl; 

    server_name your_domain.tld; 

    ssl_certificate /etc/ssl/certs/output_bundle.pem; 

    ssl_certificate_key /etc/ssl/private/your_domain_tld.key; 

    location / { 

        root /var/www/html; 

        index index.html; 

    } 

} 

server { 

    listen 80; 

    server_name <your_domain.tld>; 

    return 301 https://$host$request_uri; 

} 

To activate your site’s SSL configuration in NGINX, create a symbolic link from sites-available to sites-enabled: 

sudo ln -s /etc/nginx/sites-available/your_domain.tld /etc/nginx/sites-enabled

Step 5. Test and Restart Your Server to Apply the Changes 

Test your configuration changes to ensure they work: 

sudo nginx -t 

Next, restart your NGINX server: 

sudo systemctl reload nginx 

In a new browser window, load your website using the secure HTTPS protocol to ensure the SSL certificate is active and valid.

If manually handling all of those tasks isn’t your preference (or doing so is infeasible because you have too many certificates to manage individually), then this next approach will be a better option. This involves using GeoTrust Horizon’s AutoInstall SSL agent…

Automatic Method: Use AutoInstall SSL to Add SSL to Your Server  

Step 1: Select Automation as Your Installation Method 

Log in to your GeoTrustHorizon account. In the dashboard, click on All Orders and select the Get Started button next to your certificate order number on the next page.  

Press Complete Certificate Enrollment to begin the process. Select Automatic Installation in the Certificate Enrollment process to specify your choice of installation method: 

Step 2: Specify Your Server Type 

For the Installation Instructions on the next screen, select Linux Server (Apache/NGINX) as your web server and specify whether you want to use File validation or DNS validation.  

Step 3: Install the Automation Agent & Your Certificate on NGINX  

Install AutoInstall SSL on NGINX (Ubuntu) 

SSH into your NGINX server and begin the installation process using the following command: 

sudo wget -qO - https://files.autoinstallssl.com/packages/linux/version/latest/get.autoinstallssl.sh | sudo bash -s

Install Your Server Certificate 

Run the AutoInstall SSL agent to install your SSL/TLS certificate using the following command. (Note: Be sure to replace the placeholder value <your_unique_token> with your authentic token, or simply copy-paste the command from your GeoTrust Horizon dashboard, as it will already include the token value) : 

sudo runautoinstallssl.sh installcertificate --token <your_unique_token> --<validationtype file.txt> --validationprovider filesystem

Related: Learn additional AutoInstall SSL Agent Commands using this handy guide.

Verify the SSL Agent Was Installed Successfully 

The AutoInstall SSL agent will automatically  

• generate the CSR,  
• initiate and complete domain validation (based on your selected method),  
• retrieve the signed SSL certificate, and  
• update your NGINX configuration with the appropriate certificate paths and settings.

Once the process is ready, simply press Enter to execute and finalize the installation. 

Step 4: Test to Ensure the Changes Are Live on Your Site 

Now the last process, simply visit the secure version of your site (i.e., https://your_domain.tld) and verify it is using a secure, encrypted connection (HTTPS). 

That’s it! Now, you’ve successfully set up AutoInstall SSL to automatically handle SSL/TLS certificate installations on your server for this domain.  

Why Choose Automatic Installation Over Manual? 

1. Stay Ahead of Short-Term Certificate Expirations 

As major browsers and certificate authorities shift toward shorter certificate lifespans (e.g., 47-day validity), manually tracking renewals becomes a burden. Automation ensures your certificate is always up to date — avoiding unexpected security warnings or outages. 

2. Frees Up Time So You Can Focus on Other Priorities 

Automatic installation via GeoTrust Horizon’s AutoInstall SSL agent handles the entire process — everything from CSR generation and domain validation to certificate deployment — within minutes. 

3. No More Typos or Misconfigurations 

Manual setups can be error-prone, especially when dealing with NGINX config files and certificate paths. AutoInstall SSL applies configurations with precision, saving you from hard-to-troubleshoot mistakes. 

4. Never Worry About Renewal Deadlines Again 

With auto-renewal enabled, GeoTrust Horizon’s AutoInstall SSL makes sure your certificates stay valid — no need to set calendar reminders or face last-minute panic when an SSL expires. 

5. Perfect for First Timers and Non-Techies 

You don’t need to master OpenSSL commands or dig through NGINX settings. Just run one simple command to install the AutoInstall SSL agent, and it takes care of everything behind the scenes. 

Common Questions 

What if I already have an SSL certificate installed on NGINX Ubuntu — can I replace it with a new one? 

Yes. Simply upload the new .crt, .key, and .ca-bundle files, replace the paths in your NGINX config, and reload the server. Make sure the filenames and permissions are updated correctly. 

Do I need to restart NGINX every time I renew or update my SSL certificate? 

Yes, after renewing or updating your certificate files, you must reload or restart NGINX Ubuntu to apply the changes: 

sudo systemctl reload nginx  

What’s the difference between fullchain.pem and certificate.crt in NGINX?

The fullchain.pem combined file includes your domain certificate and the intermediate CA bundle. NGINX requires the full chain to establish trust, which is why we concatenate both files when creating fullchain.pem. 

How can I verify if the SSL certificate is installed correctly? 

Use a browser to check for HTTPS and a valid certificate, or use tools like: 

curl -Iv https://yourdomain.com  

Alternatively, try online SSL checkers like CertPanel’s SSL Monitor.

Is it safe to leave my private key on the server? 

Yes, provided that it’s stored in /etc/ssl/private/ with 600 permissions (i.e., no ability to read, write, or execute) and is only accessible by root only. (Never share or expose your .key file.) 

Will AutoInstall SSL overwrite my existing NGINX configuration? 

No. AutoInstall SSL safely appends SSL-related directives. If it detects an existing SSL config, it will update only the relevant sections without affecting unrelated settings. 

Can I run AutoInstall SSL in non-interactive mode (for scripts or automation)? 

Yes, the agent supports non-interactive execution with flags like –token, –validationtype, and –validationprovider, making it ideal for CI/CD or provisioning pipelines. 

Additional Tips 

• Ensure your server’s time and date are correct to avoid certain SSL validation issues. 
• Regularly check your SSL certificates’ expiration dates to avoid service interruptions. 
• Consider using a strong Diffie-Hellman group server-level configuration setting for better security. 
• Use a tool like GeoTrust Horizon’s SSL Monitor feature to test your SSL configuration and identify potential vulnerabilities.