User Tools

Site Tools


Sidebar

nginx_ssl

Make A Self-signed SSL certificate

cd /etc/nginx
openssl req -new -x509 -nodes -out server.crt -keyout server.key
chmod 600 server.key

Global Settings

ssl_protocols TLSv1.2 TLSv1.1 TLSv1;    
ssl_prefer_server_ciphers on;
ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !RC4";

If you want to support IE8/XP, change the last line to

ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS +RC4 RC4";

Example Site Configuration Part

listen 443 ssl spdy;
ssl_certificate /etc/nginx/server.crt;
ssl_certificate_key /etc/nginx/server.key;

Redirect to HTTPS

location / {
    return 301 https://example.com$request_uri;
}

As A Force-HTTPS Reverse Proxy

proxy_redirect   http:// $scheme://
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Scheme $scheme;

Verify A CRT Matches A KEY

openssl x509 -noout -modulus -in server.crt | openssl md5
openssl rsa -noout -modulus -in myserver.key | openssl md5

If the output are not the same, then they do not match and won't work on Nginx.

Generating a Certificate Signing Request (CSR)

openssl req -new -newkey rsa:2048 -nodes -keyout $DOMAIN.key -out $DOMAIN.csr

CSR Fields

  • Country Code: The two-letter International Organization for Standardization (ISO-) format country code for the country in which your organization is legally registered. Click the link below for a complete list of ISO country codes. ISO Country Codes
  • State/Province: Name of state, province, region, territory where your organization is located. Please enter the full name. Do not abbreviate
  • City/Locality: Name of the city/locality in which your organization is registered/located. Please spell out the name of the city/locality. Do not abbreviate.
  • Organization: The name under which your business is legally registered. The listed organization must be the legal registrant of the domain name in the certificate request. If you are enrolling as a small business/sole proprietor, please enter the certificate requester's name in the “Organization” field, and the DBA (doing business as) name in the “Organizational Unit” field.
  • Organizational Unit: Optional. Use this field to differentiate between divisions within an organization. For example, “Engineering” or “Human Resources.” If applicable, you may enter the DBA (doing business as) name in this field.
  • Common name: The name entered in the “CN” (common name) field of the CSR MUST be the fully-qualified domain name for the website you will be using the certificate for (e.g., “www.domainnamegoeshere”). Do not include the “http:” or “https:” prefixes in your common name. Do NOT enter your personal name in this field.

If you are requesting a Wild Card certificate, please add an asterisk (*) on the left side of the common name (e.g., “*.domainnamegoeshere.com”). This will secure all subdomains of the common name.

NOTE: If you enter “www.domainnamegoeshere.com” as the Common Name in your certificate signing request, the certificate will secure both “www.domainnamegoeshere.com” and “domainnamegoeshere.com.” And vice versa.

References:

nginx_ssl.txt · Last modified: 2017/01/05 06:10 by felixonmars