There is a point to this story, but it has temporarily escaped my mind...
Contact Me MyFaceBook MyLinkedIn MyGitHub MyTwitter

Configure NGINX web server to use SSL

  1. You need an installed NGINX web server
  2. You also need an SSL key and certificate, but you can use Let's Encrypt for signed SSL certificates as well.
  3. Copy the certificate and key to /etc/ssl
  4. Configure the server to serve an SSL site:
    cat > /tmp/ssl<< EOF
    server {
        listen 443 ssl http2;
     
        ssl on;
        ssl_certificate /etc/ssl/certs/cert.pem;
        ssl_certificate_key /etc/ssl/private/cert.key;
     
        ssl_ciphers 'kEECDH+ECDSA+AES128 kEECDH+ECDSA+AES256 kEECDH+AES128 kEECDH+AES256 +SHA !aNULL !eNULL !LOW !MD5 !EXP !DSS !PSK !SRP !kECDH !CAMELLIA !RC4 !SEED';
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_session_timeout 5m;
        ssl_session_cache shared:SSL:10m;
     
        ssl_stapling on;
        ssl_stapling_verify on;
     
        ssl_prefer_server_ciphers on;
        ssl_dhparam /etc/ssl/certs/dhparam.pem;
     
        add_header Strict-Transport-Security max-age=63072000;
        add_header X-Frame-Options DENY;
        add_header X-Content-Type-Options nosniff;
     
        keepalive_timeout 90;
     
        location / {
            proxy_set_header X-Real-IP \$remote_addr;
            proxy_set_header X-Forwarded-For \$remote_addr;
            proxy_set_header Host \$host;
            proxy_pass http://127.0.0.1:80;
        }
    }
    EOF
     
    sudo mv /tmp/ssl /etc/nginx/sites-available/
     
    sudo ln -s /etc/nginx/sites-available/ssl /etc/nginx/sites-enabled/ssl
     
    cd /etc/ssl/certs
    sudo openssl dhparam -out /etc/ssl/certs/dhparam.pem 4096
     
    sudo service nginx reload
Copyright © 2019 by Julian Easterling. SOME RIGHTS RESERVED.
Privacy Policy              Terms of Use             


Creative Commons License
Except where otherwise noted, content on this site is
licensed under a Creative Common Attribution-Share Alike 4.0 International License.


All of the opinions expressed on this website are those of Julian Easterling and
do not represent the views of any of my current and previous clients or employers in any way.

If you notice an error on the site or content that has not been properly attributed, bring
it to my attention using the contact page and I will endeavor to fix it as soon as I can.

I accept no responsibility or liability for any damages incurred by following any of
my advice or by using any of the information on my site or of those sites that I link to.