Till now, we have installed Nginx and did a simple configuration to host an html file locally. In this part we will be configuring Nginx with a self-signed SSL certificate.
We will be creating a self signed certificate using openssl and make Nginx use it for serving content over https. Let’s get our hands dirty. Open our pal, Terminal and lets create a couple of folders to store our key and certificate. Fire the following commands:
mkdir -p /usr/local/etc/ssl/private
mkdir -p /usr/local/etc/ssl/certs
Ideally you can create these folders anywhere but it’s a good practice to have them at the above given path. We will now create key and certificate by running the below command:
sudo openssl req \ -x509 -nodes -days 365 -newkey rsa:2048 \ -keyout /usr/local/etc/ssl/private/self-signed.key \ -out /usr/local/etc/ssl/certs/self-signed.crt
Let’s alter our server context from previous tutorial. The updated file is as below.
events {}
http {
server {
# Listen on port 80 which is the default http port
listen 80;
# Set a permanent redirection from http to https
return 301 https://localhost:443;
}
}
Add another server context inside http context with configuration and locations relating to SSL
server {
listen 443 ssl;
# location of ssl certificate
ssl_certificate /usr/local/etc/ssl/certs/self-signed.crt;
# location of ssl key
ssl_certificate_key /usr/local/etc/ssl/private/self-signed.key;
}
Add location context inside the ssl server context
location / {
root /Users/arjav/Desktop/www;
index index.html index.htm;
}
This is the whole configuration file:
events {
}
http {
# HTTP server
server {
listen 80;
return 301 https://localhost:443;
}
# HTTPS server
server {
listen 443 ssl;
ssl_certificate /usr/local/etc/ssl/certs/self-signed.crt;
ssl_certificate_key /usr/local/etc/ssl/private/self-signed.key;
location / {
root /Users/arjav/Desktop/www;
index index.html index.htm;
}
}
}
As a last step we will need to add the self-signed certificate to the system keychain. Run the below command in your terminal.
sudo security add-trusted-cert \ -d -r trustRoot \ -k /Library/Keychains/System.keychain /usr/local/etc/ssl/certs/self-signed.crt
Voila! That’s it. In your terminal verify your configuration file by running nginx -t and if everything looks okay reload your Nginx server by running nginx -s reload. Visit https://127.0.0.1. You will still see a red flag or “Not secure” sign in your browser saying that your certificate is invalid, but that it’s because not signed by a third-part authority. Rest assured the content is served over secure channels.
In the next chapter we will look at some advanced ssl configuration options for better security, caching and optimisation.
Comments