Certificate Management Service:Deploy an SSL certificate on an Nginx server (Windows)

Requirements

Step 1: Prepare the SSL certificate

1. Go to the SSL Certificates Service page. In the Actions column for your certificate, click More to open the certificate details page. On the Download tab, download the certificate for the Nginx Server Type.

2. Decompress the downloaded certificate package.

   • If the package contains both a certificate file (.pem) and a private key file (.key), securely store both files. You need them for deployment.

   • If the package contains only a certificate file (.pem) and no private key file (.key), you must deploy the certificate together with the private key file that you saved locally.

     Note

     If you generated a certificate signing request (CSR) file by using a tool such as OpenSSL or Keytool when you applied for the certificate, the private key file is stored only on your local machine and the downloaded package does not contain the private key file. If the private key is lost, the certificate becomes unusable. You must purchase a paid certificate and generate a new CSR and private key.

3. Upload the extracted certificate and private key files to your server and store them in a secure directory. The example path used in this topic is D:\cert.

   Note

   The following steps use an Alibaba Cloud ECS instance as an example. For other server types, consult the vendor documentation.

   1. Go to ECS console - Instances. In the top-left corner, select the region and resource group for the target resource.

   2. Go to the instance details page. Click Connect and select Workbench. Follow the on-screen instructions to log on to the server.

   3. Click the Start menu in the lower-left corner of the server desktop, and then find and open This PC, Computer, or File Explorer.

   4. Under Redirected drives and folders, double-click workbench on ***. Drag the certificate files from your local machine into this directory, and then right-click and select Refresh to refresh the folder.

      

   5. Copy the files to the D:\cert directory.

      Important

      Workbench clears files from Redirected drives and folders when you reconnect or exit the instance. Use this directory only for transfer—do not store files here permanently.

Step 2: Configure the system and network

1. Open port 443 in the security group.

   Important

   If your server is deployed on a cloud platform, make sure that its security group allows inbound traffic on TCP port 443. Otherwise, the service is not accessible from the internet. The following operations use an Alibaba Cloud ECS instance as an example. For other cloud platforms, see their official documentation.

   1. Go to the ECS Instances page, select the region where your target ECS instance is located, and click the instance name to go to the details page.

   2. Click Security Groups > Inbound Rules and make sure a rule exists with Action set to Allow, Protocol Type set to TCP, Port Range set to HTTPS(443), and Authorization Object set to Anywhere (0.0.0.0/0).

   3. If such a rule does not exist, add one to the target security group. For more information, see Add a security group rule.

2. Open port 443 in the server firewall.

   1. Log on to your Windows server, click the Start menu, and then open Control Panel.

   2. Go to System and Security > Windows Defender Firewall > Check firewall status.

   3. If the firewall is turned off as shown in the following figure, no further action is required.

   4. If the firewall is turned on, follow these steps to allow HTTPS traffic.

      1. In the left-side navigation pane, click Advanced settings > Inbound Rules and check whether an inbound rule exists for which Protocol is TCP, Local Port is 443, and Action is Block.

      2. If such a rule exists, right-click the rule, select Properties, and on the General tab, change the action to Allow the connection. Then, click Apply.

Step 3: Deploy the certificate on Nginx

1. Open the Nginx configuration file (for example, D:\nginx-1.28.0\conf\nginx.conf) and configure the SSL certificate and private key.

   1. Add a server block that listens on port 443.

      Duplicate the port 80 server block, change the listen directive to listen 443 ssl, and add the SSL directives (ssl_certificate and ssl_certificate_key).

      # Original server block listening on port 80
      server {
          listen 80;
          server_name yourdomain.com www.yourdomain.com;
      
          # Other configurations
          location / {
              proxy_pass http://127.0.0.1:8000;
          }
      }
      
      # Duplicate the existing server block for port 80 and add it as a new server block.
      server {
          # Change 'listen 80' to 'listen 443 ssl'
          listen 443 ssl;
          # Keep the original server_name. You can add more domain names supported by the certificate.
          server_name yourdomain.com www.yourdomain.com;
      
          # ======================= Certificate Configuration Start =======================
          # Specify the certificate file (intermediate certificates can be concatenated into this .pem file). Replace the following path with the absolute path to your certificate file.
          ssl_certificate D:\\cert\\example.com.pem;
          # Specify the private key file. Replace the following path with the absolute path to your private key file.
          ssl_certificate_key D:\\cert\\example.com.key;
          # Configure the SSL session cache to improve performance.
          ssl_session_cache shared:SSL:1m;
          # Set the SSL session timeout.
          ssl_session_timeout 5m;
          # Customize the TLS protocols and cipher suites (This is an example. Adjust as needed.)
          ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
          # Specify the allowed TLS protocol versions. Higher TLS versions provide better security but may have lower browser compatibility.
          ssl_protocols TLSv1.2 TLSv1.3;
          # Prioritize the server's cipher suites.
          ssl_prefer_server_ciphers on;
          # ======================= Certificate Configuration End =======================
      
          # Other configurations
      }

   2. Optional: Redirect HTTP requests to HTTPS automatically. Add the rewrite directive to the existing server block that listens on port 80.

      server {
          listen 80;
          # Enter the domain name bound to the certificate.
          server_name <YOURDOMAIN>;
          # Redirect all HTTP requests to HTTPS with a 301 status code.
          return 301 https://$host$request_uri;
      }

   3. Validate the configuration. If the output shows syntax is ok and test is successful, the configuration is correct. Otherwise, fix the reported errors and retest.

      .\nginx.exe -t

2. Reload the Nginx service.

   Open Command Prompt, navigate to the Nginx installation directory, and run:

   .\nginx.exe -s reload 

Step 4: Verify the deployment

Deploying to production

When you deploy an application in a production environment, follow these best practices to improve security, stability, and maintainability:

• Run the application as a non-administrator user:

  Create a dedicated, low-privilege system user for the application. Do not run the application by using an account that has administrative permissions.

  Note

  We recommend that you use a gateway-level SSL configuration. This involves deploying the certificate on a reverse proxy, such as an SLB or Nginx instance.

• Externalize credential management:

  Do not hard-code sensitive information, such as passwords, in your code or configuration files. Use environment variables, a vault, or a Key Management Service provided by your cloud provider to inject credentials.

• Enforce HTTP-to-HTTPS redirection:

  Make sure that all traffic that accesses your website over HTTP is automatically redirected to HTTPS. This helps prevent man-in-the-middle (MITM) attacks.

• Configure modern TLS protocols:

  In your server configuration, disable obsolete and insecure protocols, such as SSLv3, TLS 1.0, and TLS 1.1. Enable only TLS 1.2 and TLS 1.3.

• Monitor certificates and automate renewal:

  After the certificate is deployed, we recommend that you enable domain name monitoring. Alibaba Cloud automatically checks the validity period of the certificate and sends reminders before the certificate expires. This helps you renew the certificate in a timely manner to prevent service interruptions. For more information, see Purchase and enable public domain name monitoring.

Certificate not working or HTTPS inaccessible

Common causes include:

• Port 443 is not open in the security group or firewall. Open it as described in Configure the system and network.

• The Bound Domains of the certificate does not cover the domain you are accessing. Check the Domain name matching prerequisite.

• Nginx was not reloaded after the configuration change. Reload the Nginx service.

• The certificate files were not replaced correctly, or the Nginx configuration points to the wrong path. Verify that both the configuration and certificate files are current.

• The domain name is integrated with cloud services such as CDN, SLB, or WAF, but the certificate is not installed on the corresponding service. For more information, see Certificate deployment location when traffic passes through multiple cloud services.

• The domain name resolves to multiple servers, but the certificate is installed on only some of them. You must install the certificate on each server.

How do I update an SSL certificate in Nginx?

Back up the existing .pem and .key files on your server. Download the new certificate from the Certificate Management Service console and upload it to the same path with the same file names, overwriting the old files. Reload Nginx to apply the change.

How do I disable TLSv1.0 and TLSv1.1 in Nginx?

In the Nginx server block that listens on port 443, set ssl_protocols to include only TLSv1.2 and TLSv1.3: ssl_protocols TLSv1.2 TLSv1.3;. This disables the insecure TLSv1.0 and TLSv1.1 protocols. After updating the configuration, run .\nginx.exe -s reload to apply the changes.

After running nginx -s reload, Nginx fails to start or the bind() to 0.0.0.0:443 failed error appears in the logs.

This is a port conflict. Run netstat -ano | findstr ":443" to check whether port 443 is in use, and stop the service that is occupying it.

Troubleshooting the missing lock icon or "mixed content" warnings

This happens when the page loads resources such as images, CSS, or JavaScript over HTTP. Inspect the page source code and change all http:// links to https://, or use relative paths such as /images/logo.png.