Nginx

This article or section is a stub. Stubs are articles that have not yet received substantial attention from the authors. They are short or insufficient pieces of information and require additions to further increase the article's usefulness. The project values stubs as useful first steps toward complete articles. See Wiki workflow and Wikipedia:Stub for more details on this process. See all the stubs in Category:Stubs

<bash>wget http://www.dotdeb.org/dotdeb.gpg cat dotdeb.gpg

Self-signed SSL certificates

Nginx doesn't use the basic .pem files that can be used by Apache for self-signed certificates. We need to go through the following procedure to turn the pem into key and crt files.

First we need to create a private key. Note that this process will require a pass-phrase for the key - don't worry, we'll remove it later to make things easier,

openssl genrsa -des3 -out ssl.key 1024

Now we need to create a CSR (Certificate Signing Request):

openssl req -new -key ssl.key -out ssl.csr

Now we need to remove the pass-phrase otherwise it'll prevent the web-server from restarting without it being entered (you'll need to enter the pass-phrase to remove it though),

cp ssl.key ssl-pass.key openssl rsa -in ssl-pass.key -out ssl.key

Now we can generate the actual certificate:

openssl x509 -req -days 365 -in ssl.csr -signkey ssl.key -out ssl.crt

The relevant server section can now be updated in the nginx configuration,

listen 80; listen 443 default ssl; ssl_certificate /etc/nginx/certs/ssl.crt; ssl_certificate_key /etc/nginx/certs/ssl.key;

See also

• Config example for Apache people
• Self-signed certs in Nginx
• StartSSL & Nginx
• Nginx best practices
• Configuring Nginx HTTPS servers