- Root or sudo access to your server
- Nginx installed and running
- A valid SSL certificate (CRT/PEM), private key, and CA bundle files
- Your domain DNS pointing to the server IP
Table of Contents
1 Prepare your certificate files
After purchasing and validating your SSL certificate, your provider will send you a ZIP file or email containing the following files:
2 Upload certificates to the server
Create a dedicated directory for your SSL files:
sudo mkdir -p /etc/nginx/ssl/yourdomain.com
sudo chmod 700 /etc/nginx/ssl/yourdomain.comUpload your certificate files from your local machine using SCP:
scp your_domain.crt your_domain.key ca_bundle.crt user@your_server_ip:/etc/nginx/ssl/yourdomain.com/Set correct permissions on each file:
sudo chmod 600 /etc/nginx/ssl/yourdomain.com/your_domain.key
sudo chmod 644 /etc/nginx/ssl/yourdomain.com/your_domain.crt
sudo chmod 644 /etc/nginx/ssl/yourdomain.com/ca_bundle.crt3 Create the certificate chain
Nginx requires a single chained certificate file that combines your domain certificate and the CA bundle:
cat /etc/nginx/ssl/yourdomain.com/your_domain.crt /etc/nginx/ssl/yourdomain.com/ca_bundle.crt > /etc/nginx/ssl/yourdomain.com/chained.crt4 Configure the Nginx server block
Open your Nginx server block configuration file. It is usually located at /etc/nginx/sites-available/yourdomain.com or inside /etc/nginx/conf.d/
sudo nano /etc/nginx/sites-available/yourdomain.comAdd or update the server block with the following SSL configuration:
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name yourdomain.com www.yourdomain.com;
ssl_certificate /etc/nginx/ssl/yourdomain.com/chained.crt;
ssl_certificate_key /etc/nginx/ssl/yourdomain.com/your_domain.key;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
root /var/www/yourdomain.com;
index index.php index.html;
location / {
try_files $uri $uri/ =404;
}
}Replace yourdomain.com and the root path to match your actual domain and web root directory.
5 Test and reload Nginx
Always test your configuration for syntax errors before reloading. A misconfiguration can bring down your web server.
sudo nginx -tIf the output shows syntax is ok and test is successful, reload Nginx:
sudo systemctl reload nginx6 Force HTTPS redirect
Add a second server block in the same config file to redirect HTTP (port 80) to HTTPS:
server {
listen 80;
listen [::]:80;
server_name yourdomain.com www.yourdomain.com;
return 301 https://$host$request_uri;
}Save the file, then test and reload Nginx:
sudo nginx -t && sudo systemctl reload nginx7 Verify the SSL installation
Use the following command to check your certificate details directly from the server:
echo | openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null | openssl x509 -noout -dates -subjectYou can also verify online using any SSL checker tool. Your browser should now show a padlock icon when visiting your domain over HTTPS.
- Browser shows a padlock icon on your domain
- https://yourdomain.com loads without any security warnings
- http:// automatically redirects to https://
- SSL checker shows no chain errors and correct expiry date
