Installing a certificate on nginx

Prerequisites

• Access to the server with root rights or sudo.
• nginx is installed and running.
• The combined PEM file from regfish, containing the server certificate and the intermediates (certificate-example.com.pem).
• The private key from the certificate request (private.key), see creating a CSR.

After issuance you find the PEM file in the dash under SSL/TLS → your certificate → downloads, as the full PEM file or inside the ZIP package.

Placing the files

sudo mkdir -p /etc/nginx/ssl
sudo cp certificate-example.com.pem /etc/nginx/ssl/
sudo cp private.key /etc/nginx/ssl/

The permissions are not a detail: the key must be readable by root only.

sudo chmod 644 /etc/nginx/ssl/certificate-example.com.pem
sudo chmod 600 /etc/nginx/ssl/private.key

Adjusting the server block

Open the configuration of the website, often /etc/nginx/sites-available/default:

server {
    listen 443 ssl;
    server_name example.com www.example.com;

    ssl_certificate     /etc/nginx/ssl/certificate-example.com.pem;
    ssl_certificate_key /etc/nginx/ssl/private.key;

    # Recommended settings
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;

    root  /var/www/html;
    index index.html index.htm;
}

The order inside the file matters

nginx has no separate chain directive: server certificate and intermediates live in one file, the server certificate first. That is exactly how regfish delivers the PEM file, so there is nothing to assemble. With the chain missing, browsers often still look fine while command line tools and older devices refuse the connection.

Test and reload

sudo nginx -t
sudo systemctl reload nginx

nginx -t checks the configuration before it goes live; reload then applies it without dropping connections.

Checking the installation

Open the website over HTTPS and make sure the browser reports no certificate errors. A test service such as the Qualys SSL Labs server test checks more thoroughly and also catches an incomplete chain.

The certificate watch reports every new certificate issued for this name, including one ordered by somebody else. It does not watch your own certificate for expiry: the automation in the next section is what covers that.

All of this automatically

If you would rather not repeat this on every renewal, automate issuance and installation with certbro or the recipe ACME certificates with lego.