How to Set Up an SSL Certificate for Nginx: Let’s Encrypt and OpenSSL

Every website should use HTTPS. It encrypts traffic, protects logins and forms, and browsers warn visitors about sites without it. This guide shows two ways to set up an SSL certificate for Nginx:

1. a free, trusted certificate from Let’s Encrypt, for public websites;
2. a self-signed certificate with OpenSSL, for labs and internal testing.

It finishes with a secure TLS configuration and ways to test it. Strictly speaking, modern certificates are used with TLS, not the old SSL protocol, but the name “SSL certificate” has stuck.

Prerequisites

• Nginx installed and serving your site over HTTP. See how to install Nginx.
• For Let’s Encrypt: a public domain name pointing to the server, and port 80 open.
• A user with sudo rights.

Option 1: Free certificate from Let’s Encrypt

Let’s Encrypt is a free, automated certificate authority. Its Certbot tool requests the certificate, edits Nginx and sets up renewal.

Install Certbot

On Ubuntu and Debian:

sudo apt install -y certbot python3-certbot-nginx

On Rocky Linux, AlmaLinux or CentOS Stream (with EPEL enabled):

sudo dnf install -y epel-release
sudo dnf install -y certbot python3-certbot-nginx

Request the certificate

sudo certbot --nginx -d example.com -d www.example.com

Certbot proves you control the domain, installs the certificate and can redirect HTTP to HTTPS.

Check automatic renewal

Let’s Encrypt certificates are short-lived, currently 90 days. Certbot installs a timer that renews them automatically. Test it with:

sudo certbot renew --dry-run

Option 2: Self-signed certificate with OpenSSL

Self-signed certificates encrypt traffic, but browsers do not trust them. So use them only for labs, internal tools or testing.

sudo mkdir -p /etc/nginx/ssl
sudo openssl req -x509 -nodes -days 365 -newkey rsa:3072 \
  -keyout /etc/nginx/ssl/selfsigned.key \
  -out /etc/nginx/ssl/selfsigned.crt \
  -subj "/CN=lab.example.local" \
  -addext "subjectAltName=DNS:lab.example.local"
sudo chmod 600 /etc/nginx/ssl/selfsigned.key

Modern browsers require the subject alternative name (SAN), so always include it.

Configure Nginx for HTTPS

For a self-signed certificate, or to tune a Certbot setup, use a server block like this:

server {
    listen 80;
    server_name lab.example.local;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    http2 on;
    server_name lab.example.local;

    ssl_certificate     /etc/nginx/ssl/selfsigned.crt;
    ssl_certificate_key /etc/nginx/ssl/selfsigned.key;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:10m;

    add_header Strict-Transport-Security "max-age=31536000" always;

    root /var/www/html;
}

Note that the http2 on; directive needs Nginx 1.25.1 or later. On older versions, use listen 443 ssl http2; instead.

Then test and reload:

sudo nginx -t && sudo systemctl reload nginx

Remember to open port 443 in the firewall.

Test your HTTPS setup

curl -vI https://example.com
openssl s_client -connect example.com:443 -servername example.com

For public sites, an online TLS scanner shows protocol support, certificate chain issues and configuration grades.

Common problems

• Certificate chain incomplete: use the full-chain file, not just the site certificate.
• Port 80 blocked: Let’s Encrypt HTTP validation fails.
• Mixed content: pages load some resources over HTTP; update links to HTTPS.
• Expired certificate: check that the renewal timer runs.

Related guides

• How to install Nginx from source
• Linux server hardening checklist

Sources

• Let’s Encrypt: Getting started
• nginx.org: Configuring HTTPS servers

Running Linux servers in production? Our Linux server hardening & security audit checks configuration, patching, SSH and logging. You can also use our free Linux server hardening checklist, or contact us.