{"id":261,"date":"2013-10-10T15:54:44","date_gmt":"2013-10-10T15:54:44","guid":{"rendered":"http:\/\/www.nicovs.be\/?p=261"},"modified":"2013-10-10T15:58:15","modified_gmt":"2013-10-10T15:58:15","slug":"configure-a-site-with-ssl-on-an-nginx-server","status":"publish","type":"post","link":"https:\/\/www.nicovs.be\/?p=261","title":{"rendered":"Configure a site with SSL on an Nginx server"},"content":{"rendered":"

This post describes how to setup a server block on nginx with a Thawte SSL123 certificate.<\/p>\n

This how to can of course also be used with other SSL vendors (comodo, digicert, …) but you’ll have to change some steps of course \ud83d\ude42<\/p>\n

First, we’ll start with the certificate request.<\/span><\/p>\n

To create your request, use the openssl command:<\/span><\/p>\n

openssl req -newkey rsa:2048 -nodes -keyout www.securedomain.com.pem -out www.securedomain.com.csr<\/pre>\n
And follow the SSL csr generation process:<\/p>\n
Generating a 2048 bit RSA private key\r\n................ 2013\/25106\/ giochi da casino gratis<\/a> \/LTT del 1° ottobre 2013 - Avviso di annullamento di biglietti di lotteria istantanea oggetto di furto11-10-2013 - Lotterie istantanee Nota Prot........................................................+++\r\n..............................+++\r\nwriting new private key to 'www.securedomain.com.pem'\r\n-----\r\nYou are about to be asked to enter information that will be incorporated\r\ninto your certificate request.\r\nWhat you are about to enter is what is called a Distinguished Name or a DN.\r\nThere are quite a few fields but you can leave some blank\r\nFor some fields there will be a default value,\r\nIf you enter '.', the field will be left blank.\r\n-----\r\nCountry Name (2 letter code) [AU]:BE\r\nState or Province Name (full name) [Some-State]:VL\r\nLocality Name (eg, city) []:Brussels\r\nOrganization Name (eg, company) [Internet Widgits Pty Ltd]:IT Company Name\r\nOrganizational Unit Name (eg, section) []:IT Dpt\r\nCommon Name (e.g. server FQDN or YOUR name) []:www.securedomain.com\r\nEmail Address []:it@securedomain.com\r\n\r\nPlease enter the following 'extra' attributes\r\nto be sent with your certificate request\r\nA challenge password []:\r\nAn optional company name []:<\/pre>\n
Now, if you look inside of your CSR files, you’ll see something like<\/p>\n
-----BEGIN CERTIFICATE REQUEST-----\r\n...\r\n...\r\n...\r\n-----END CERTIFICATE REQUEST-----<\/pre>\n
Now it’s time to go and buy your certificate at your favorite SSL reseller…<\/p>\n
Be sure to have a mailbox to be able to send your certificate approval email to (mainly this is: admin@securedomain.com or webmaster@, hostmaster@, administrator@,…)<\/p>\n
Once you have received your SSL Certificate from Thawte, create a new file and paste in the certificate.<\/p>\n
So paste it inside of www.securedomain.com.crt<\/p>\n
Thawte has upgraded their root hierarchy to 2048bit RSA Keys (more information<\/a>), \u00a0so you need the Intermediate CA to support old web browsers. For the nginx web server you can download the file from Thawte here by:<\/p>\n
wget https:\/\/search.thawte.com\/library\/VERISIGN\/ALL_OTHER\/thawte%20ca\/SSL123_CA_Bundle.pem<\/pre>\n
One you have this file, echo the contents and paste it at the end of your crt file.<\/p>\n
cat SSL123_CA_Bundle.pem >>  www.securedomein.com.crt<\/pre>\n
Now enable SSL in your nginx server block by:<\/p>\n
server {\r\n  listen 80;\r\n  listen 443 default ssl;\r\n\r\n  ssl_certificate     \/var\/www\/www.securedomain.com\/ssl\/www.securedomain.com.crt;\r\n  ssl_certificate_key \/var\/www\/www.securedomain.com\/ssl\/www.securedomain.com.pem;\r\n\r\n  server_name     www.securedomain.com\r\n                  ;\r\n\r\n  root   \/var\/www\/www.securedomain.com\/wwwroot;\r\n\r\n  index   index.php index.html;\r\n\r\n...<\/pre>\n
In my example, your site will listen to both Port 80 and 443 (SSL), you can of course redirect http to https by adding this in your nginx server block config:<\/p>\n
###Add Redirect SSL\r\nserver {\r\n  listen   80;\r\n\r\n  server_name securedomain.com\r\n              www.securedomain.com;\r\n\r\n\t\t\t   rewrite ^ https:\/\/www.securedomain.com$request_uri? permanent;\r\n}\r\n### End Redirect to SSL\r\nserver {\r\n  listen 443 default ssl;\r\n\r\n  ssl_certificate     \/var\/www\/www.securedomain.com\/ssl\/www.securedomain.com.crt;\r\n  ssl_certificate_key \/var\/www\/www.securedomain.com\/ssl\/www.securedomain.com.pem;\r\n\r\n  server_name     www.securedomain.com\r\n                  ;\r\n\r\n  root   \/var\/www\/www.securedomain.com\/wwwroot;\r\n\r\n  index   index.php index.html;\r\n\r\n  ...\r\n  ...<\/pre>\n
 <\/p>\n","protected":false},"excerpt":{"rendered":"
This post describes how to setup a server block on nginx with a Thawte SSL123 certificate. This how to can of course also be used with other SSL vendors (comodo, digicert, …) but you’ll have to change some steps of course \ud83d\ude42 First, we’ll start with the certificate request. To create your request, use the […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[4,45,31,72,6,1],"tags":[],"class_list":["post-261","post","type-post","status-publish","format-standard","hentry","category-debian","category-linux","category-php-fpm-2","category-ssl","category-ubuntu","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/www.nicovs.be\/index.php?rest_route=\/wp\/v2\/posts\/261","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.nicovs.be\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.nicovs.be\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.nicovs.be\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.nicovs.be\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=261"}],"version-history":[{"count":4,"href":"https:\/\/www.nicovs.be\/index.php?rest_route=\/wp\/v2\/posts\/261\/revisions"}],"predecessor-version":[{"id":265,"href":"https:\/\/www.nicovs.be\/index.php?rest_route=\/wp\/v2\/posts\/261\/revisions\/265"}],"wp:attachment":[{"href":"https:\/\/www.nicovs.be\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=261"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.nicovs.be\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=261"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.nicovs.be\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=261"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}