The Must-Have Guide to NGINX SSL Configuration

According to NetCraft, in September 2025, NGINX was used by over 333 million websites, making this open-source web server a popular (and valuable) target for cybercriminals. If your website is built on NGINX, enhance the security of your server with an SSL/TLS certificate.

This guide will take you through the Ubuntu 20/22 NGINX SSL/TLS configuration process, whether you use a manual or automated SSL installation method. The time to discover how to set your NGINX SSL configuration to enhance your security starts… now.

Pre-Requisites for NGINX SSL/TLS Configuration on Ubuntu

The first step is to ensure you have a valid SSL/TLS certificate ready for installation. If you don’t have one yet, submit your certificate signing request (CSR) to a trusted certificate authority (CA) or vendor.

We recommend choosing one of our GeoTrust SSL/TLS certificates (for obvious reasons). As a CA that’s been around for nearly 25 years, we know a thing or two about delivering quality SSL/TLS certificates. And if you’re a GeoTrust Horizon user, you can purchase your certificates easily through your account dashboard.

Manual Method: Step-By-Step NGINX SSL/TLS Configuration

In this article, we focus specifically on the NGINX SSL certificate configuration steps. Hence, we’ll assume you’ve already purchased and installed the certificate on your server.

1. Provide Key Information (Literally) About Your Server

Your website operates based on the contents of its NGINX virtual host configuration file, usually located at /etc/nginx/sites-available/default. Consequently, if you want your web server to exchange data over a secure HTTPS connection, you must update its configuration file accordingly. To do so, follow the steps below.

Open Your Server’s Configuration File

Open a terminal and access your NGINX configuration file using the following command. (Be sure to replace the blue-colored placeholder text with your config file’s name):

sudo nano /etc/nginx/sites-available/default

Specify Your Server, Certificate, and Key Information

Scroll down to the server block section and copy-paste the original HTTP server module info. Then add the lines in italics. Replace the blue-colored parts with your paths, certificates, key, and domain information. Note: The .tld is your top-level domain (e.g., .com, .org, .co.uk, etc.).

server {
    listen443;
    ssl on;
    ssl_certificate /path/to/your/signed certificate bundle; 
    ssl_certificate_key /path/to/your/private key;
    server_name your.domain.tld;
    access_log /var/log/nginx/nginx.vhost.access.log;
    error_log /var/log/nginx/nginx.vhost.error.log;
    location / {
  	root /your/existing/configuration;
    	index index.html;
    }

2. Specify Protocol Versions and Ciphers

Let’s ensure your website’s HTTPS connection is really secure by adding a few essential parameters.

Disable Unsecure Protocols and Optimize Cipher Suites

In the same server block, copy and paste your chosen protocols and cipher-related information so it is placed between the server_name and access_log sections in the example below. (We’ve indicated it as the parts that must be updated or added marked in the color blue in the example below.)

server {
    listen443;
    ssl on;
    ssl_certificate /path/to/your/signed certificate bundle;
    ssl_certificate_key /path/to/your/private key;
    server_name your.domain.tld;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
    access_log /var/log/nginx/nginx.vhost.access.log;
    error_log /var/log/nginx/nginx.vhost.error.log;
    location / {
  	root /your/existing/configuration;
    	index index.html;
    }
    }

Note: The ssl_ciphers in our example above are based on a list of actual good cipher suites suggested by the Mozilla SSL Configuration Generator. Ensure you check them regularly and update the list based on your needs. 

3. Optimize Your Website’s Performance

A fast website translates into a smooth experience and happier users. So, before saving your NGINX SSL/TLS configuration, improve your website’s performance in one step.

Increase Your SSL Cache and Timeout

Copy the lines written in Italics (listed after the protocol and ciphers information) in the example below and paste them between the ssl_ciphers and access_log lines. If you wish, you can replace the bold parts to adapt them to your site’s specific needs.

Just consider that 1MB of shared cache can hold approximately 4,000 sessions. So, the 40m (i.e., 40 megabytes) illustrated in the example below equates to roughly 160,000 cached sessions.

server {
    listen443;
    ssl on;
    ssl_certificate /path/to/your/signed certificate bundle; 
    ssl_certificate_key /path/to/your/private key;
    server_name your.domain.tld;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
    ssl_session_cache shared:SSL:40m;
    ssl_session_timeout 4h;
    access_log /var/log/nginx/nginx.vhost.access.log;
    error_log /var/log/nginx/nginx.vhost.error.log;
    location / {
  	root /your/existing/configuration;
    	index index.html;
    }
    }

4. Redirect Your HTTP Website to HTTPS

Don’t save your configuration file yet. First, ensure all your website’s traffic is moving from HTTP to HTTPS.

How to Add an HTTPS Redirection

Copy the command below and paste it just underneath the server module we’ve just created/updated. As usual, replace the blue part with your data. 

server { 
    listen 80; 
    server_name your.domain.tld; 
    return 301 https://$host$request_uri; 
} 

From now on, no matter what page your user visits on your website, they’ll be redirected to the HTTPS (secure) version of your site.

Save Your File

Now your server block configuration should look like the one below:

server {
    listen443;
    ssl on;
    ssl_certificate /path/to/your/signed certificate bundle; 
    ssl_certificate_key /path/to/your/private key;
    server_name your.domain.tld;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
    ssl_session_cache shared:SSL:40m;
    ssl_session_timeout 4h;
    access_log /var/log/nginx/nginx.vhost.access.log;
    error_log /var/log/nginx/nginx.vhost.error.log;
    location / {
  	root /your/existing/configuration;
    	index index.html;
    }
    }
server { 
    listen 80; 
    server_name your.domain.tld; 
    return 301 https://$host$request_uri; 

Pro Tip: Do you want to play it safe? Instead of modifying the configuration file, create a new one. In your terminal, type: sudo nano /etc/nginx/sites-available/your_domain.tld. Then follow the same process described above.

To save your changes, press CTRL + O.

5. Enable Your Site in the NGINX SSL/TLS Configuration Settings

When NGINX starts or is reloaded, it checks the configuration files listed in the /etc/nginx/sites-enabled directory. As your configuration file is saved in the /etc/nginx/sites-available/ directory, you’ll have to point NGINX in the right direction so that it can retrieve — and use — the correct file. Here’s how you do it.

Create a Link Pointing to Your Configuration File

In the terminal, create a symbolic link from sites-available to sites-enabled and press Enter:

sudo ln -s /etc/nginx/sites-available/your.domain.tld /etc/nginx/sites-enabled

Validate Your NGINX SSL/TLS Configuration

To ensure that your new configuration is error-free, copy and paste this command:

sudo nginx -t

If everything worked correctly, you should get a message confirming that the configuration file syntax is correct and that the test was successful.

Restart NGINX

Reload using this command:

sudo systemctl reload nginx

Congratulations! You’ve just manually completed your NGINX SSL/TLS certificate configuration. From now on, your website should automatically load the secure HTTPS version. Double-check everything to ensure it is live by visiting the secure version of your website (the “https://” version of your domain) in your browser. For example, https://securitytest.site.

Beware, though. If you have more than one website and have purchased a multi-domain or wildcard certificate, you’ll have to repeat the same process for each domain and subdomain.

This isn’t great if you aren’t a big fan of playing with the NGINX terminal. It’s even worse as far as scalability is concerned when you have too many certificates to manage. But do you know what is great? You can set the NGINX SSL certificate configuration process to autopilot using an automation agent such as AutoInstall SSL.

AutoInstall SSL makes the installation process faster and easier than completing all of those manual processes… by yourself… for every individual certificate…

Step-By-Step NGINX SSL Configuration Using an SSL Automation Agent

Let’s say you’re a GeoTrust Horizon user who has chosen to install and configure your new SSL/TLS certificate using automation. (Good choice, by the way!) Here’s how to get started…

Install and Configure Your SSl Automation Agent

Select the Automatic Installation option, as seen in screenshot #1, and specify which type of server the certificate will be installed on (i.e., NGINX), as seen in screenshot #2:

Now, it’s time to choose whether to use GeoTrust Horizon’s AutoInstall SSL agent or ACME Certbot.

Option #1: AutoInstall SSL

To install and set up the SSL automation agent on your NGINX server, use the following command:

An alternative is to use ACME Certbot.

Option #2: ACME CertBot

For this method, click the Agent Options link seen in the previous screenshot, located just below the command box.

Install and Configure Your SSL/TLS Certificate

Next, you must confirm that you’ve installed your preferred automation method. After that, it’s time to install your SSL certificate using the automation agent or client.

For this example, we’ll use AutoInstall SSL.

Run AutoInstall SSL to Start the Configuration Process

SSH into your server and run the following script (below) in your terminal window. Remember to replace the parts in blue with your SSL/TLS certificate’s token and file information:

sudo runautoinstallssl.sh installcertificate --token <token value> –your validationtype file.txt --validationprovider filesystem

Important: Always ensure the script matches the one displayed in your AutoInstall SSL dashboard. It’ll look something like this:

Confirm the Installation and Configuration of Your SSL/TLS Certificate

When prompted, answer the question “Do you want to continue with the installation process?” by hitting Y followed by Enter.

The AutoInstall SSL agent will automatically: 

• Generate the CSR and submit it to the CA, 
• Complete the domain validation process, 
• Download and install the SSL/TLS certificate, and 
• Update your NGINX SSL/TLS certificate configuration, redirection included. 

The beauty of it? All this will be done in one bite and in a matter of seconds. Furthermore, AutoInstall SSL comes with a set of cool configuration options, such as auto updates and the possibility to choose when it’ll automatically renew or install a new certificate before its expiration date.

Now, before you stop reading, open your browser and go to your website. Can you spot the padlock near the URL? Marvelous. Job done.

Final Words About NGINX SSL Configuration

Now it’s your turn. Get your SSL/TLS certificate and set it up following our Ubuntu 20/22 NGINX SSL installation quick guide. You’ll ensure that the information exchanged between the server and your customers’ browsers remains confidential, keep malicious actors at bay, and boost users’ trust in your brand.