This guide shows how to SSL-enable Nginx so sites & blogs are https rather than boring old http. So now you really can sell ice to the eskimos.
Ideal for web application security as well as eCommerce and vpsBible’s budding banking community, upgrading Nginx-powered websites with SSL’s cryptographic protocols may sound daunting but is actually far too easy.
So whether you are setting up shop or want to add an extra layer of anti-hack protection, else both, read on.
Setup Unmanaged VPS: The Ubuntu-Nginx Guide
Take your virtual private server from zero to hero
.. from blank box to cute-as server ..
with this easy-to-follow copy/paste guide.
22+ parts with video, here’s the index.
What is the Secure Sockets Layer (SSL)?
It’s a ridiculously clever means of channeling data securely across networks, made famous by online shopping and banking but also ideal for logging into web application admin areas without getting your password sniffed by a naughty neighbor.
- Rather than http://foo ..
- SSL uses https://footoo
Here at vpsB we (OK, that’s me) salivate over its next of kin, SSH or Secure Shell, which gives us that all-important tunnelled connection to our VPS boxes. SSH is built on SSL, using its key-pair handshake authentication system.
That said, let’s look at how to set it up for Nginx.
Being tremendous forward thinkers we already set up Nginx with the required SSL module * – http_ssl_module – so need now just to tweak the config to kick it up. While this tutorial has a few aside tips along the way it is mainly concerned with:-
- editing our nginx.conf
- editing the virtual host file for yourdomain.com
- and for those of us that don’t have a certificate yet but want to play, we’ll roll our own
* If you didn’t and want to recompile, Compile an Advanced Nginx Module Configuration is just the ticket.
Configure SSL for Nginx: nginx.conf, Reconf’ed
Assuming root and backing up in case of injury, let’s take a look at the regular nginx.conf:-
Compare that to some of the changes below. Doubtless there will be values to tune to your need but this works for SSL as well as your existing setup so, allowing for any tweaks you have made since following Nginx (better than Apache) Web Server, replace with this:-
Save and exit the file.
(You could pop SSL directives here too but it’s more logical to add them to the virtual host, talking of which ..)
Configure SSL for Nginx: Virtual Host, Unhinged/Rehung
Having cajoled Nginx into liking the whole SSL idea we can embed the thing into a site or three. There are numerous ways you can do this depending on your requirement but the principle remains the same:-
- redirect some bit of the web to get securely socketted
- switch on the protocols
- give it a certificate and key
- provide options if you like
Another day another vhost or, if your’re setting up a new domain, cheat:-
In the first of the two server blocks we amend the redirect to goto https-for-sugar:-
What Was That All About?
Here’s the deal:-
- listen 443; SSL/https generally runs on this port, not 80 which is for http
- server_name www.YOURDOMAIN.COM; actually this is the same, just testing your powers of observation
- ssl on; enable SSL
- ssl_certificate /usr/local/nginx/conf/server.crt;
the location of our certificate - ssl_certificate_key /usr/local/nginx/conf/server.key; .. and the certificate’s key
Configure SSL for Nginx: Sub-Sites and SSL
Just a tip: A nice idea is to have, say, https://shopping.mydomain.com, https://admin.mydomain.com or https://hackoff.mydomain.com.
To do that, simply follow the Adding Sub-Domains with Nginx tutorial, extrapolating the SSL values here into the logic of that, whatever that means.
Configure SSL for Nginx: Advanced Tuning
There are various parameters for the Secure Socket Layer if you fancy a tweak. I’d suggest to get the basic up and running, then toy with these if you can’t sleep:-
- ssl_ciphers HIGH:!ADH:!MD5; cryptography
- ssl_prefer_server_ciphers on; ditto
- ssl_protocols SSLv3; stronger encryption, rather good
- ssl_session_cache shared:SSL:1m; some caching thing, doubtless useful
- ssl_session_timeout 5m; let them shop-happy
There’s even more enthusiasm about these and other variables at Nginx’ http_ssl_module wiki page.
Configure SSL for Nginx: SSL Certificate & Key
Coming in at anything between a-few-hundred and a-many-hundred $bucks, you tend to buy these from places like Verisign (not a recommendation, shop around geddit) to look smart but, if you’re just testing or want SSL, for example, as a safer way to log into a web app backend – which is an excellent idea, doncha know – then be cheap like me and create a free certificate instead:-
Stand Easy
Bin root before you bin any docs:-
SSL and You
.. likely the cheesiest title in the world of SSL, let me know how you get on and, if you’ve got some advanced use of SSL, do me a favor and tell me so I can take profit from your hard work. Thank you. And sorry, I was in a silly mood while tapping out this piece but, then again, what’s new?
Something else ..
Setup Unmanaged VPS: The Ubuntu-Nginx Guide
Take your virtual private server from zero to hero
with this easy-to-follow copy/paste guide.
“My local PC runs Windows” Show me for Linux/Mac
“My local machine is Linux/Mac” Show me for Windows
22+ parts with video, here’s the index ..
-
Setup Unmanaged VPS: The Ubuntu-Nginx Guide
Introducing vpsBible’s how-to guide for setting up a super-charged unmanaged VPS featuring Ubuntu and Nginx.
-
VPS (Virtual Private Server) vs Shared vs Dedicated
Before getting stuck in, let’s compare the web host types in detail and weigh up the differences between managed & unmanaged VPS.
-
Set Up a VPS Linux Distribution
Opening a VPS hosting account, we’ll choose, configure & launch a Linux server ‘distribution’.
-
Set Up Command Line Interface (CLI) using PuTTY
Now we’ve got a server to play with, we’ll connect to it, using the ’ssh’ protocol for a super-secure link.
-
Create a Linux User & Set Permissions
Initially you’ve logged into your remote Linux machine as ‘root’. We’ll add you as a user now, with root or SuperUser permissions.
-
Encrypt Data with OpenSSH & Auto-Login with PuTTY
Now we can use ‘authentication keys’ to shore up our connection while simplifying login to an automated, password-free yet secure process.
-
Harden the Secure Shell (SSH) & Create a Firewall
The final security step: galvanizing the OpenSSH protocol and setting up an ‘iptables’ firewall. Now the server is rock ruddy solid.
-
Edit bashrc for User-Friendly Linux, plus System Updates
We use the terminal a whole lot so let’s cut ourselves a break and create some command shortcuts, then update the server.
-
Add a Domain Zone to Your VPS
To make your server aware of yourDomain.com you’ll need a few ‘DNS’ records. Damn this is simple I’m practically asleep!
-
Prepare Linux Server for Email with Postfix
In order to send and receive email from our web applications we’ll install some software and tweak the ‘RDNS’ record.
-
Install PHP5 & MySQL – The One-Stop FastCGI Index Page
Add PHP5 & MySQL, but which FastCGI method is best? Here’s the benchmarking, 4 ways to install/compile, add caching modules & more.
-
Nginx (better than Apache) Web Server
Let’s install this supersonic web server, tweaking its file structure & adding default configuration files.
-
Setup FileZilla for Secure FTP (SFTP)
There’s FTP, and then there’s ‘Secure FTP’. We’ll set up FileZilla using SFTP – and those authentication keys – for secure file transfers.
-
Serve Multiple Sites & Blogs with Virtual Hosts
We want a website folder structure, some permissions, some site-specific configuration files and, hey, we’ll hook up ‘FastCGI’.
-
Adding Sub-Domains with Nginx
Need a sub-domain? If you do, here’s how to add subDomain.yourSite.com with an ‘A record’ and a configuration file.
-
Integrate A CMS Like WordPress, WP MU, Drupal etc
For those of you wanting to use a specific content framework, such as a CMS, blogging or forum software, pop in here and we’ll sort that out.
-
Google Apps for Domain-Specific Email
GA’s free Standard Edition for catchall webmail – POP-ping or IMAP-ped to your desktop client – saves precious server resources for your webs.
-
Moving Day! How to Move Your Blog or Site
Nearly there. Here’s the web site or blog migration guide, relocating to your VPS with minimal or no downtime.
Manage Unmanaged VPS: Ubuntu-Nginx Administration
Already set it up? We’d best maintain it then.
Got a Question? Want to Comment?
This site has no comments system. We've got a better system!
Please use the link at the top of the post and goto this topic's forum thread:-
For those posts ported from Guvnr.com (pre-Feb/2010), archive comments remain.
Handy info from these comments is in the process of being ported to the forum and attributed to the original author.
If you think this idea sucks, let me know.
Thank you.