Home / Docs / Server certificate install guide (Nginx)

Server certificate install guide (Nginx)

The full flow: generate a CSR, build the chain, configure Nginx SSL, and back up.

Server certificate install guide (Nginx)

The full flow on Nginx — from generating a certificate request to installing and backing up.

1. Generate a private key and CSR

Use OpenSSL to create a 2048-bit key and a CSR:

# private key
openssl genpkey -algorithm RSA -out server.key -pkeyopt rsa_keygen_bits:2048

# certificate request
openssl req -new -key server.key -out server.csr

The second command prompts for country, state, city, organization, unit and the Common Name (the domain the certificate is bound to, e.g. www.yourdomain.com). Then submit server.csr for issuance.

Back up server.key and do not delete it before the issuance email arrives — a lost key means the certificate cannot be installed.

2. Prepare the certificate files

The issuance email contains the server certificate and the intermediate CA certificate. For client compatibility, combine them into a chain file server.pem:

  • Paste the server certificate (from -----BEGIN CERTIFICATE----- to -----END CERTIFICATE-----) into a text editor;
  • Right after it (new line, no blank line) paste the intermediate CA certificate; if the email has multiple CA segments, paste them in order;
  • Save as server.pem.

Or combine on the command line:

cat server.crt intermediate.crt > server.pem

3. Configure Nginx

Copy server.key and server.pem into Nginx's conf directory and edit nginx.conf:

server {
    listen       443 ssl;
    server_name  www.yourdomain.com;

    ssl_certificate      server.pem;
    ssl_certificate_key  server.key;
    ssl_session_timeout  5m;
    ssl_session_cache    shared:SSL:10m;

    ssl_protocols        TLSv1.2 TLSv1.3;
    ssl_ciphers          HIGH:!aNULL:!MD5:!RC4;
    ssl_prefer_server_ciphers on;

    location / {
        root   html;
        index  index.html index.htm;
    }
}

TLS 1.2/1.3 requires OpenSSL 1.0.1+. On older OpenSSL, temporarily use ssl_protocols TLSv1.1 TLSv1.2;.

4. Redirect HTTP to HTTPS

server {
    listen 80;
    server_name www.yourdomain.com;
    return 301 https://$host$request_uri;
}

5. Test and reload

nginx -t && nginx -s reload

Then open the site over https:// and confirm the padlock appears and the chain is complete.

6. Backup & restore

After a successful install, back up server.key and server.pem. To restore, put both files back into the conf directory, reconfigure as above and reload Nginx.

← Docs