How to generate a self-signed SSL certificate on Nginx web server?

Generating a self-signed SSL certificate for an Nginx web server involves several steps, including installing the OpenSSL library, generating a private key, creating a certificate signing request (CSR), and generating a self-signed certificate. Here’s a detailed guide:

Prerequisites:

1. Nginx web server: Ensure you have Nginx installed and configured on your system.
2. OpenSSL library: Install the OpenSSL library to generate cryptographic keys and certificates.

Steps:

1. Install OpenSSL library: Use your system’s package manager to install the OpenSSL library. For example, on Ubuntu or Debian, use the command:

sudo apt install openssl

3. Generate a private key: Use the openssl genrsa command to generate a private key for your certificate. Replace <strong>your_domain_name</strong> with the domain name for which you want to generate the certificate:

openssl genrsa -out <strong>your_domain_name</strong>.key 2048

4. Create a certificate signing request (CSR): Use the openssl req command to create a CSR containing information about your certificate, including your domain name, organization, and contact details. Replace <strong>your_domain_name</strong> with the domain name for which you generated the private key:

openssl req -new -key <strong>your_domain_name</strong>.key -out <strong>your_domain_name</strong>.csr -subj "/CN=<strong>your_domain_name</strong>"

5. Generate a self-signed certificate: Use the openssl x509 command to generate a self-signed certificate using the CSR and private key you created. Replace <strong>your_domain_name</strong> with the domain name for which you generated the CSR:

openssl x509 -req -days 365 -in <strong>your_domain_name</strong>.csr -signkey <strong>your_domain_name</strong>.key -out <strong>your_domain_name</strong>.crt

5. Configure Nginx to use the self-signed certificate: Edit your Nginx configuration file (usually /etc/nginx/sites-available/default). Locate the section where you define the website’s document root and SSL configuration. Replace <strong>your_domain_name</strong> with the domain name for which you generated the certificate:

server {
    listen 443 ssl;
    server_name <strong>your_domain_name</strong>;
    root /var/www/html;

    ssl_certificate /path/to/<strong>your_domain_name</strong>.crt;
    ssl_certificate_key /path/to/<strong>your_domain_name</strong>.key;
}

6. Restart Nginx: Restart the Nginx web server to apply the new configuration:

sudo systemctl restart nginx

To make your self-signed certificate more trustworthy, you can purchase a certificate from a reputable Certificate Authority (CA). CA-issued certificates are trusted by major web browsers, providing greater assurance for your website visitors.