HTTPS with Ngnix

HTTPS and the TLS protocol can be used to achieve secure communication between a web server (e.g. nginx) and a client (browser). This protects - today more than ever - a connection from eavesdropping or modification, e.g. by a man-in-the-middle attack.

Create an SSL certificate with OpenSSL

The basis of secure communication are certificates, which must also be created in the first step.

sudo mkdir /etc/nginx/ssl
sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/nginx/ssl/nginx.key -out /etc/nginx/ssl/nginx.crt

• openssl: Tool to manage and generate certificates and keys.
• req: Describes an X.509 certificate signing request for the public key procedure.
• -x509: Specifies to issue a self-signed certificate instead of a CSR.
• -nodes: Certificate is not protected by a password. This means that nginx can be started without any further action (entering the password).
• -days 365: Describes the validity of the certificate for 365 days.
• -newkey rsa:2048: Generates the certificate and a 2048-bit RSA key.
• -keyout: Specifies the output path and file for the key.
• -out: Specifies the output path and file for the certificate.

When the certificate is set up, various data about the issuer is requested. The Common Name is particularly important. This should correspond to the host name (e.g. raspberrypi) or the FQDN (e.g. meinpi.de). Save the directory and the files: chmod 0600 /etc/nginx/ssl/*

The setup is done with a self-signed certificate and should therefore only be used in a private/non-productive environment. For public or productive purposes, use certificates from a trusted, public certification authority!

Set up HTTPS in nginx

Now the certificates for use are stored in the Nginx configuration directory.

The server instructions of the /etc/nginx/sites-available/default file should look something like this for secure use of HTTPS:

server {
        listen 80;
        listen [::]:80;
        server_name domain.com;
        return 301 https://$server_name$request_uri;
}
server {
        listen 443 ssl;
        listen [::]:443 ssl;
        server_name domain.com;
        root /usr/share/nginx/;
        index index.html index.htm;
        ssl_certificate /etc/nginx/ssl/nginx.crt; # add certificate
        ssl_certificate_key /etc/nginx/ssl/nginx.key; # adds private key
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # defines the protocols
        ssl_ciphers HIGH:!aNULL:!MD5; # defines the ciphersuites
        location / {
                try_files $uri $uri/ =404;
        }
        ...
}

The first block instructs to forward all requests on port 80 to https://… Block two, listening on port 443, establishes the SSL/TLS connection via HTTPS.

These are all the settings that are made in Nginx. Finally, only the service has to be restarted. sudo service nginx restart

Checking the HTTPS connection

Now all requests to “http://domain.de” must be redirected directly to “https://domain.de”. On the first call, a security message will appear in the browser stating that the certificate is not trusted. This must be trusted because it is self-signed and does not appear to be trusted via the certificate store (e.g. via the root certificate authorities in Windows).