Configuring a Self-Signed SSL Certificate for Nginx

To ensure a secure connection between the web browser and the server, HTTPS is almost the only choice. HTTPS is essentially HTTP over SSL, meaning it establishes an HTTP connection on top of an SSL secure connection.

SSL uses certificates to create secure connections. There are two verification modes:

1. Only the client verifies the server’s certificate; the client does not provide its own certificate;
2. The client and server mutually verify each other’s certificates.

Obviously, the second method offers higher security and is commonly used by online banks. However, standard websites typically use the first method.

How does the client verify the server’s certificate? The server’s certificate must be signed by a “trusted” authority certificate, which in turn might be signed by an even more authoritative certificate. Tracing this chain upwards, the topmost most authoritative certificate is called the root certificate. Root certificates are built directly into browsers, allowing the browser to use its built-in root certificates to verify whether a specific server’s certificate is valid.

To provide a valid certificate, the server’s certificate must be signed by a Certificate Authority (CA) like VeriSign so that browsers can verify it successfully. Otherwise, the browser will display a warning that the certificate is invalid.

The cost for applying for a certificate signature varies from tens to hundreds of dollars per year. Therefore, if it is only for management purposes, you can create a self-signed certificate to ensure administrators can securely connect to the server via the browser.

Below is a brief introduction on how to create a self-signed SSL certificate.

Creating a self-signed certificate requires installing OpenSSL. Follow these steps:

1. Create a Key;
2. Create a signing request;
3. Remove the passphrase from the Key;
4. Sign the certificate using the Key.

For certificates prepared for HTTPS, note that the Common Name (CN) in the created signing request must exactly match the domain name; otherwise, it will fail browser verification.

Since the above commands are cumbersome, I have created a shell script that handles the entire certificate process at once. Download the script here:

https://github.com/michaelliao/itranswarp.js/blob/master/conf/ssl/gencert.sh

Run the script. Assuming your domain is www.test.com, enter as prompted:

$ ./gencert.sh 
Enter your domain [www.example.com]: www.test.com          
Create server key...
Generating RSA private key, 1024 bit long modulus
.................++++++
.....++++++
e is 65537 (0x10001)
Enter pass phrase for www.test.com.key: Enter passphrase
Verifying - Enter pass phrase for www.test.com.key: Enter passphrase
Create server certificate signing request...
Enter pass phrase for www.test.com.key: Enter passphrase
Remove password...
Enter pass phrase for www.test.com.origin.key: Enter passphrase
writing RSA key
Sign SSL certificate...
Signature ok
subject=/C=US/ST=Mars/L=iTranswarp/O=iTranswarp/OU=iTranswarp/CN=www.test.com
Getting Private key
TODO:
Copy www.test.com.crt to /etc/nginx/ssl/www.test.com.crt
Copy www.test.com.key to /etc/nginx/ssl/www.test.com.key
Add configuration in nginx:
server {
    ...
    ssl on;
    ssl_certificate     /etc/nginx/ssl/www.test.com.crt;
    ssl_certificate_key /etc/nginx/ssl/www.test.com.key;
}

The red text indicates input. Note that the passphrase entered four times must be identical.

Four files will be created in the current directory:

• www.test.com.crt: The self-signed certificate
• www.test.com.csr: The certificate signing request
• www.test.com.key: The Key without a passphrase
• www.test.com.origin.key: The Key with a passphrase

The web server needs to send www.test.com.crt to the browser for verification, and then use www.test.com.key to decrypt data sent by the browser. The remaining two files do not need to be uploaded to the web server.

Taking Nginx as an example, you need to configure it within server {...}:

server {
    ...
    ssl on;
    ssl_certificate     /etc/nginx/ssl/www.test.com.crt;
    ssl_certificate_key /etc/nginx/ssl/www.test.com.key;
}

If everything goes smoothly, open your browser to access the website via HTTPS. On the first visit, a warning will appear (because our self-signed certificate is not trusted by the browser). Import the certificate into the system via the browser (use Internet Explorer on Windows, Safari on Mac) and set it as “Trusted.” From then on, that computer can securely connect to the web server when visiting the site:

How do you configure certificates in application servers? For example, Tomcat, Gunicorn, etc. The correct approach is not to configure them there. Let Nginx handle HTTPS, and then connect to the backend application server via HTTP through a proxy. This effectively uses Nginx as a secure proxy from HTTPS to HTTP, leveraging Nginx’s HTTP/HTTPS processing capabilities while avoiding the drawbacks of application servers being less proficient in handling HTTPS.