How to install an SSL/TLS certificate on Nginx (OpenSSL)
The instructions below walk you through installing SSL on Nginx. If you have more than one server or device, you will need to install the certificate on each one you want to protect. If you have not generated your certificate or finished validation yet, see our CSR generation instructions and skip the steps below.
What you will need
1. Your server certificate
This is the certificate the certificate authority issued for your domain. It may have been emailed to you. If not, you can download it from your account dashboard by clicking on your order.
2. Your intermediate certificates
These files let devices connecting to your server identify the issuing certificate authority. There may be more than one of them. If your certificate arrived in a ZIP folder, the intermediates — sometimes called the CA bundle — should be in there too. If not, download the right CA bundle for your certificate.
3. Your private key
This file should be on your server, or in your hands if you generated your CSR with a free generator tool. On some platforms, such as Microsoft IIS, the private key is not immediately visible to you but the server keeps track of it.
Installation instructions
1. Copy your certificate files
Copy the certificate files into the right directory on your server.
Note: for safety, make them readable by root only.
2. Join your files together
You need to join the two certificates — "concatenate" them — into a single file:
cat your_domain_name.crt Intermediate.crt >> bundle.crt
3. Edit your virtual host file
Edit your Nginx virtual host file. Copy the existing server block — the insecure one — and paste it below the original before adding the lines shown here:
server {
listen 443 ssl;
ssl on;
ssl_certificate /etc/ssl/your_domain_name.pem; # o bundle.crt
ssl_certificate_key /etc/ssl/your_domain_name.key;
server_name your.domain.com;
access_log /var/log/nginx/nginx.vhost.access.log;
error_log /var/log/nginx/nginx.vhost.error.log;
location / {
root /home/www/public_html/your.domain.com/public/;
index index.html;
}
}
4. Restart Nginx
Restart Nginx with:
sudo /etc/init.d/nginx restart
That is it — your SSL certificate is installed. To check your work, open the site in your browser at https://yourdomain.tld and look at the certificate and site information to confirm HTTPS is working properly. Remember that you may need to restart your server before the changes take effect.
To check your installation properly, use our SSL Checker. If something does not add up, get in touch and we will look at it with you.
