- \n
- The manual method of using OpenSSL and a Comodo SSL\/TLS certificate<\/a>, and <\/li>\n\n\n\n
- Using CertPanel’s AutoInstall SSL automation agent<\/a>. <\/li>\n<\/ol>\n\n\n\n
\nLearn more About AutoInstall SSL<\/a><\/div>\n<\/div>\n\n\n\nWhether you\u2019re setting up a new site or securing an existing one, this article will walk you through the process step-by-step.\u202f <\/p>\n\n\n\n
Prerequisite: You Must Have an SSL Certificate\u202f<\/strong> <\/h2>\n\n\n\n
To install SSL on your Ubuntu server, you\u2019ll need a valid SSL certificate. We recommend choosing a Comodo SSL Certificate<\/strong> for trusted encryption, compatibility, and flexible options to suit different needs. (You can purchase an SSL\/TLS certificate easily through your CertPanel user account dashboard.) <\/p>\n\n\n\n
\nBuy an SSL Certificate<\/a><\/div>\n<\/div>\n\n\n\nManual Method: A Step-By-Step Guide to Installing SSL on NGINX <\/strong><\/h2>\n\n\n\n
This section will show you how to install and configure an SSL\/TLS certificate manually on your NGINX server. \u202f <\/p>\n\n\n\n
Step 1: Generate & Submit a Certificate Signing Request (CSR) <\/strong><\/h3>\n\n\n\n
Before you can install an SSL certificate on NGINX, you\u2019ll first need to generate a CSR. To do this on your Ubuntu server using OpenSSL, use a customized version of the following command: <\/p>\n\n\n\n
openssl req -new -newkey rsa:2048 -nodes -keyout <your_domain.tld>.key -out <your_domain.tld>.csr <\/code><\/pre>\n\n\n\nReplace the generic key and CSR file names with your domain and key information: <\/p>\n\n\n\n
![\"A](\"https:\/\/certpanel.com\/resources\/wp-content\/uploads\/rudra-01-1024x524.jpg\")
Image caption:<\/em><\/strong> A redacted screenshot showing the fields of information required when completing a certificate signing request.<\/em> <\/figcaption><\/figure>\n\n\n\n This will generate your CSR, which is a long string of base-64 characters that looks similar to this redacted example: <\/p>\n\n\n\n
![\"A](\"https:\/\/certpanel.com\/resources\/wp-content\/uploads\/rudra-02-1024x586.jpg\")
Image caption:<\/em><\/strong> A redacted example of a certificate signing request.<\/em><\/figcaption><\/figure>\n\n\n\n To complete the certificate request process: <\/p>\n\n\n\n
- \n
- Go to the CertPanel Dashboard<\/strong>, navigate to All Orders<\/strong>, and locate your certificate order. <\/li>\n\n\n\n
- Click the Get Started<\/strong> button in the Order ID<\/strong> row. <\/li>\n\n\n\n
- In the CSR submission field, paste the entire content<\/strong> of your CSR file as is \u2014 including the header and footer lines: <\/li>\n<\/ul>\n\n\n\n
-----BEGIN CERTIFICATE REQUEST----- \n\n[your encoded CSR content] \n\n-----END CERTIFICATE REQUEST-----<\/code><\/pre>\n\n\n\n- \n
- Remove any extra spaces or missing lines. <\/li>\n<\/ul>\n\n\n\n
Step 2: Complete the Validation Process <\/strong><\/h3>\n\n\n\n
Complete domain validation using any of the methods listed below. We\u2019ll use HTTP file-based validation for this example. (This method is recommended for all domain validations with the exception of wildcard SSL certificates, which can\u2019t use file-based validation.) <\/p>\n\n\n\n
![\"A](\"https:\/\/certpanel.com\/resources\/wp-content\/uploads\/file-based-domain-validation-1024x243.jpg\")
Image caption:<\/strong> An example of the domain validation methods <\/em>you can choose from for domain validation.<\/figcaption><\/figure>\n\n\n\n Download the specified text file from the CertPanel dashboard. You\u2019ll upload it to the server at the specified file path. For example: \/var\/www\/html\/.well-known\/pki-validation\/<provided_by_your_certificate_provider>.txt<\/em> <\/p>\n\n\n\n
![\"A](\"https:\/\/certpanel.com\/resources\/wp-content\/uploads\/certificate-validation-status-info-1024x339.jpg\")
Image caption:<\/strong> A screenshot showing the file-based validation steps outlined in our Certificate Enrollment process.<\/em><\/figcaption><\/figure>\n\n\n\n Here\u2019s a quick example of how this will look: <\/p>\n\n\n\n
![\"A](\"https:\/\/certpanel.com\/resources\/wp-content\/uploads\/rudra-04-1024x136.jpg\")
Image caption:<\/strong> An example of the type of information you’ll see when you implement the HTTP file-based validation steps and upload the CA’s unique file to a specified location on your server.<\/em><\/figcaption><\/figure>\n\n\n\n We need to provide the following read, write, and execute (755) permissions and read and write (644) permissions to the files: <\/p>\n\n\n\n
sudo chmod 755 \/var\/www\/html\/.well-known \nsudo chmod 755 \/var\/www\/html\/.well-known\/pki-validation \nsudo chmod 644 \/var\/www\/html\/.well-known\/pki-validation\/<ca_example_file>.txt<\/code><\/pre>\n\n\n\nCheck if the test file is accessible at https:\/\/<your_domain>\/.well-known\/pki-validation\/<\/em> <validation_filename>.txt<\/em>, as shown in the example below: <\/p>\n\n\n\n
![\"A](\"https:\/\/certpanel.com\/resources\/wp-content\/uploads\/rudra-05-1024x200.jpg\")
Image caption:<\/strong> An example of what you’ll see when you check to verify whether your unique validation file has uploaded successfully to your server.<\/em><\/figcaption><\/figure>\n\n\n\n Click Request Verification<\/strong>. Wait for five minutes and then select Re-check Status<\/strong>. Do you still see the message stating that the “certificate is pending validation<\/a>\u201d? Then check out our troubleshooting guide. <\/p>\n\n\n\n
NOTE:<\/strong> You’ll be required to provide additional validation-related information for organization validation<\/a> (OV) and extended validation (EV) certificates<\/a>. <\/p>\n\n\n\n
Step 3: Download and Install the SSL\/TLS Certificate on NGINX Ubuntu<\/strong> <\/h3>\n\n\n\n
Once the CA has successfully validated your domain (and any other relevant organization information for higher-validation certificates), it issues the SSL certificate. You can download the ZIP file for your certificate from the CertPanel dashboard, as shown below: <\/p>\n\n\n\n
![\"An](\"https:\/\/certpanel.com\/resources\/wp-content\/uploads\/order-verification-screen-where-to-download-ssl-certificate-1024x455.jpg\")
Image caption:<\/strong> This example order screen shows where to download your SSL\/TLS certificate once the issuing CA has completed validation and issued your certificate.<\/em><\/figcaption><\/figure>\n\n\n\n Unzip the file folder, which will contain at least these two files: <\/p>\n\n\n\n
- \n
- my_ca_bundle.ca-bundle<\/strong> (the intermediate certificate) <\/li>\n\n\n\n
- <your_domain.tld>.crt<\/strong> (your domain\u2019s certificate) <\/li>\n<\/ul>\n\n\n\n
Upload Your Server Certificate and CA Bundle Files<\/em><\/strong> <\/h4>\n\n\n\n
Run scp<\/em><\/a> to securely copy both files to your server. NOTE:<\/strong> Replace the placeholder certificate names and other info accordingly: <\/p>\n\n\n\n
scp -i <secret_key_to_access> .\\my_ca_bundle.ca-bundle .\\<your_domain.tld>.crt <username>@<ip_address_to_access>:\/home\/<username> <\/code><\/pre>\n\n\n\nAfter uploading the certificates, use SSH to access your server and move the files to the correct location: <\/p>\n\n\n\n
sudo mv \/home\/admin\/my_ca_bundle.ca-bundle\/home\/admin\/<your_domain.tld>.crt \/etc\/ssl\/certs <\/code><\/pre>\n\n\n\nCreate the Certificate Chain<\/em><\/strong> <\/h4>\n\n\n\n
Create a full certificate chain file for NGINX by combining your server certificate and CA bundle file: <\/p>\n\n\n\n
cat \/etc\/ssl\/certs\/<your_domain.tld>.crt \/etc\/ssl\/certs\/my_ca_bundle.ca-bundle | sudo tee \/etc\/ssl\/certs\/fullchain.pem<\/code><\/pre>\n\n\n\n![\"A](\"https:\/\/certpanel.com\/resources\/wp-content\/uploads\/ca-certificate-bundle-example-1024x395.jpg\")
Image caption:<\/strong> A redacted example of a combined CA certificate and server certificate bundle.<\/em><\/figcaption><\/figure>\n\n\n\n Configure your permissions using the following standard command. (Note the following permission values: 6 = read + write for the owner, 4 = read-only for group, and 4= specifies read-only for others): <\/p>\n\n\n\n
sudo chmod 644 My_CA_Bundle.ca-bundle <your_domain.tld>.crt <\/code><\/pre>\n\n\n\nStep 4. Configure Your Permission Settings<\/strong> <\/h3>\n\n\n\n
You can either modify the default NGINX configuration file<\/strong> or (recommended) create a new configuration file<\/strong> specifically for your domain: <\/p>\n\n\n\n
sudo nano \/etc\/nginx\/sites-available\/default<\/code><\/pre>\n\n\n\nor (recommended)<\/p>\n\n\n\n
sudo nano \/etc\/nginx\/sites-available\/<your_domain.tld><\/code><\/pre>\n\n\n\nFollow your chosen file path with the following: <\/p>\n\n\n\n
server { \n\n listen 443 ssl; \n\n server_name <your_domain.tld>; \n\n ssl_certificate \/etc\/ssl\/certs\/fullchain.pem; \n\n ssl_certificate_key \/etc\/ssl\/private\/<your_domain.tld>.key; \n\n location \/ { \n\n root \/var\/www\/html; \n\n index index.html; \n\n } \n\n} \n\nserver { \n\n listen 80; \n\n server_name <your_domain.tld>; \n\n return 301 https:\/\/$host$request_uri; \n\n} <\/code><\/pre>\n\n\n\n![\"An](\"https:\/\/certpanel.com\/resources\/wp-content\/uploads\/install-ssl-certificate-chain-nginx-ubuntu-1024x383.jpg\")
<\/figure>\n\n\n\nTo activate your site’s SSL configuration in NGINX, create a symbolic link from sites-available to sites-enabled: <\/p>\n\n\n\n
sudo ln -s \/etc\/nginx\/sites-available\/securitytest.site \/etc\/nginx\/sites-enabled<\/code><\/pre>\n\n\n\nStep 5. Test and Restart Your Server to Apply the Changes<\/strong> <\/h3>\n\n\n\n
Test your configuration changes to ensure they work: <\/p>\n\n\n\n
sudo nginx -t <\/code><\/pre>\n\n\n\nNext, restart your NGINX server: <\/p>\n\n\n\n
sudo systemctl reload nginx <\/code><\/pre>\n\n\n\nVisit your website with the secure https:\/\/ protocol (in this example, we\u2019re using https:\/\/securitytest.site<\/em>) to ensure the SSL certificate is active and valid.<\/p>\n\n\n\n
![\"Install](\"https:\/\/certpanel.com\/resources\/wp-content\/uploads\/ssl-cert-example-1024x532.jpg\")
Image caption:<\/strong> An example SSL\/TLS certificate on a test site.<\/em><\/figcaption><\/figure>\n\n\n\n Automatic Method: Use AutoInstall SSL to Add SSL to Your Server\u202f<\/strong> <\/h2>\n\n\n\n
If manually handling all of those tasks isn\u2019t your preference (or doing so is infeasible because you have too many certificates to manage individually), then this next approach will be a better option. This involves the use of CertPanel’s AutoInstall SSL feature.<\/p>\n\n\n\n
\nGet AutoInstall SSL<\/a><\/div>\n<\/div>\n\n\n\nStep 1: Select Automation as Your Installation Method<\/strong> <\/h3>\n\n\n\n
Log in to your CertPanel account. In the dashboard, click on All Orders<\/strong> and select the Get Started<\/strong> button next to <\/strong>your certificate order number on the next page. <\/p>\n\n\n\n
Press Complete Certificate Enrollment<\/strong> to begin the process. Select Automatic Installation<\/strong> in the Certificate Enrollment process to specify your choice of installation method: <\/p>\n\n\n\n
![\"A](\"https:\/\/certpanel.com\/resources\/wp-content\/uploads\/automatic-install-ssl-certificate-nginx-ubuntu-1024x646.jpg\")
Image caption:<\/em><\/strong> A screenshot showing the selection options when it comes to whether you want to install your SSL certificate on NGINX Ubuntu or other distros manually or by using automation.<\/em><\/figcaption><\/figure>\n\n\n\n Step 2: Specify Your Server Type<\/strong> <\/h3>\n\n\n\n
For the Installation Instructions on the next screen, select Linux Server (Apache\/NGINX) as your web server<\/strong> and specify whether you want to use File validation<\/strong> or DNS validation<\/strong><\/a>. <\/strong> <\/p>\n\n\n\n
![\"A](\"https:\/\/certpanel.com\/resources\/wp-content\/uploads\/autoinstall-ssl-installation-platforms-972x1024.jpg\")
Image caption:<\/em><\/strong> What you’ll see when selecting your server type and preferred domain validation method. <\/em><\/figcaption><\/figure>\n\n\n\n Step 3: Install the Automation Agent & Your Certificate on NGINX <\/strong> <\/h3>\n\n\n\n
Install AutoInstall SSL on NGINX (Ubuntu)<\/em><\/strong> <\/h4>\n\n\n\n
SSH into your server and begin the installation process using the following command: <\/p>\n\n\n\n
sudo wget -qO - https:\/\/sb.files.autoinstallssl.com\/packages\/linux\/version\/latest\/get.autoinstallssl.sh | sudo bash -s<\/code><\/pre>\n\n\n\nInstall Your Server Certificate<\/em><\/strong> <\/h4>\n\n\n\n
Run the AutoInstall SSL agent to install your SSL\/TLS certificate using the following command: <\/p>\n\n\n\n
sudo runautoinstallssl.sh installcertificate --token <your unique token info> --<validationtype file.txt> --validationprovider filesystem<\/code><\/pre>\n\n\n\n - <your_domain.tld>.crt<\/strong> (your domain\u2019s certificate) <\/li>\n<\/ul>\n\n\n\n
- my_ca_bundle.ca-bundle<\/strong> (the intermediate certificate) <\/li>\n\n\n\n
- Click the Get Started<\/strong> button in the Order ID<\/strong> row. <\/li>\n\n\n\n
- Using CertPanel’s AutoInstall SSL automation agent<\/a>. <\/li>\n<\/ol>\n\n\n\n
![\"A](\"https:\/\/certpanel.com\/resources\/wp-content\/uploads\/autoinstall-ssl-installation-confirmation-1024x525.jpg\")