How to Install an SSL Certificate on NGINX

Installing an SSL certificate on an NGINX server involves three key phases:

1. generating a certificate signing request (CSR),
2. receiving the issued certificate from GeoTrust, and
3. configuring NGINX to use that certificate for HTTPS connections.

When the setup is complete, your site will load over https:// and traffic between the browser and your server will be encrypted.

Prepare Your NGINX Environment

Before working with certificates, ensure that NGINX is installed, running, and that you know where its configuration files are located. On most Linux systems, the main configuration file is /etc/nginx/nginx.conf, while individual sites are defined in files under /etc/nginx/sites-available/ and symlinked in /etc/nginx/sites-enabled/.

As a general rule of thumb, you’ll want to edit the files in /etc/nginx/sites-available/ to install an SSL certificate.

Decide where to store your key and certificate files. Commonly used directories include /etc/ssl/ or /etc/nginx/ssl/, with permissions restricting private key access to root. Creating a dedicated directory such as /etc/nginx/ssl/ helps keep both the private key and certificate bundle organized for easier management.

Step 1: Generate a Private Key and CSR

To obtain a trusted SSL certificate, you first generate a private key and a CSR using OpenSSL on the server where NGINX runs. Connect to your server via SSH and run the following command:

openssl req -new -newkey rsa:2048 -nodes -keyout yourdomain.key -out yourdomain.csr

This creates two files: a private key file (yourdomain.key) and a CSR file (yourdomain.csr) in the current directory or specified path. During the process, OpenSSL prompts for details such as country, organization, and common name (CN). The CN should be the domain you want to secure (for example, example.com or www.example.com).

After generation, open the .csr file with a text editor and copy the entire contents, including the —–BEGIN CERTIFICATE REQUEST—– and —–END CERTIFICATE REQUEST—– lines. Paste this into GeoTrust’s form when requesting your certificate, then follow the instructions to complete validation.

Step 2: Receive and Prepare Certificate Files

Once validation is complete, the certification authority (CA) issues your SSL certificate and usually provides intermediate certificates to build a full trust chain. You will receive your primary certificate file (for example, yourdomain.crt) and one or more intermediate certificates, or a combined .pem file that includes both.

Unlike Apache, NGINX requires all certificates to be combined into a single bundle file. If the certificates are separate, concatenate the primary and intermediate certificates together. On Linux, you can run:

cat yourdomain.crt intermediate.crt > ssl-bundle.crt

The order matters: your primary certificate should come first, followed by intermediate certificates. Copy the bundle file and the private key (yourdomain.key) into your chosen SSL directory, such as /etc/nginx/ssl/. Set file permissions so only privileged users can read the key:

chmod 600 /etc/nginx/ssl/yourdomain.key
chmod 644 /etc/nginx/ssl/ssl-bundle.crt

Step 3: Configure NGINX for HTTPS

With the certificate files ready, you need to update the Nginx server block to listen on port 443 and use SSL. Open the relevant server block configuration, often found in /etc/nginx/sites-available/your-site. If your site currently only listens on port 80, you can duplicate that block and adjust it for HTTPS.

Add or modify your HTTPS server block with the following directives:

server {
    listen 443 ssl;
    server_name yourdomain.com www.yourdomain.com;
    
    ssl_certificate /etc/nginx/ssl/ssl-bundle.crt;
    ssl_certificate_key /etc/nginx/ssl/yourdomain.key;
    
    root /var/www/your-site;
    index index.html index.php;
    
    location / {
        try_files $uri $uri/ =404;
    }

The ssl_certificate directive points to your combined certificate bundle, while ssl_certificate_key points to your private key file. Verify both paths match the actual locations of your files on the server.

Configure HTTP to HTTPS Redirect

To ensure all visitors use the secure version of your site, configure your HTTP server block (port 80) to redirect traffic to HTTPS. Keep the existing HTTP server block and add a redirect:

server {
    listen 80;
    \\ existing code here, add the following lines
    server_name yourdomain.com www.yourdomain.com;
    return 301 https://$host$request_uri;
}

This 301 redirect permanently redirects all HTTP traffic to the HTTPS version, preserving the requested URI path. Without this redirect, users who type your domain without “https://” would still access the insecure version.

Step 4: Test and Reload NGINX

Before reloading, always test the NGINX configuration to avoid downtime due to syntax errors. Run the following command:

nginx -t

If everything is correct, the output will indicate that the test is successful and the configuration file syntax is OK. Apply your changes by running:

systemctl reload nginx

Finally, visit https://yourdomain.com in a browser to confirm that the certificate is active and the connection is reported as secure. Click the padlock or info icon to view certificate details and verify that the issuer and expiration date are correct.

Troubleshooting Common Issues

If NGINX fails to start or reload after configuration changes, check /var/log/nginx/error.log for specific error messages. Common issues include:

• Certificate and key mismatch: If you see an error like “SSL: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch,” the private key doesn’t match your certificate. Verify you’re using the correct private key file that was generated with your CSR. If you’ve lost the original key, you’ll need to generate a new CSR and reissue the certificate.
• Incorrect certificate chain order: NGINX requires certificates in a specific order within the bundle file. Your domain certificate must come first, followed by intermediates, then the root. If browsers show “unable to verify” or “incomplete chain” errors, recreate your bundle file to ensure proper order.
• Permission denied errors: If NGINX can’t read your certificate files, check file permissions. The certificate bundle should be readable by all (644), while the private key should only be readable by root (600). Also, verify the NGINX user has access to the directory containing the certificates.
• Port 443 already in use: If another service is already listening on port 443, NGINX cannot bind to this port. Use netstat -tlnp | grep :443 to identify which process is using the port, then stop that service or configure it to use a different port.
• Mixed content warnings: After SSL installation, your browser may show warnings if your site loads resources (images, scripts, CSS) over HTTP. Audit your site to ensure all resources use HTTPS or protocol-relative URLs (//example.com/style.css).
• Other issues: If the certificate paths, permissions, and bundle are all correct but you still encounter issues, verify that your firewall allows traffic on port 443 and that your domain’s DNS records point to the correct server IP address.