Certificate Management Service:Install an SSL certificate on an Nginx or Tengine server (Linux)

Check whether port 443 is open

Run the following command to test connectivity on port 443. Replace <your_server_public_ip> with the server's public IP address.

RHEL/CentOS

command -v nc > /dev/null 2>&1 || sudo yum install -y nc
# Replace <your_server_public_ip> with the public IP address of your server.
sudo ss -tlnp | grep -q ':443 ' || sudo nc -l 443 & sleep 1; nc -w 3 -vz <your_server_public_ip> 443

If the output is Ncat: Connected to <your_server_public_ip>:443, port 443 is open. Otherwise, complete the steps below.

Debian/Ubuntu

command -v nc > /dev/null 2>&1 || sudo apt-get install -y netcat
# Replace <your_server_public_ip> with the public IP address of your server.
sudo ss -tlnp | grep -q ':443 ' || sudo nc -l -p 443 & sleep 1; nc -w 3 -vz <your_server_public_ip> 443

If the output is Connection to <your_server_public_ip> port [tcp/https] succeeded! or [<your_server_public_ip>] 443 (https) open, port 443 is open. Otherwise, complete the steps below.

Open port 443 in your security group

Go to the Elastic Compute Service (ECS) instances page and click the target instance name. In the Security Group Details section, add a rule with the following settings and then click Add a security group rule:

Open port 443 in your system firewall

Run the following command to identify your active firewall:

if command -v systemctl >/dev/null 2>&1 && systemctl is-active --quiet firewalld; then
    echo "firewalld"
elif command -v ufw >/dev/null 2>&1 && sudo ufw status | grep -qw active; then
    echo "ufw"
elif command -v nft >/dev/null 2>&1 && sudo nft list ruleset 2>/dev/null | grep -q 'table'; then
    echo "nftables"
elif command -v systemctl >/dev/null 2>&1 && systemctl is-active --quiet iptables; then
    echo "iptables"
elif command -v iptables >/dev/null 2>&1 && sudo iptables -L 2>/dev/null | grep -qE 'REJECT|DROP|ACCEPT'; then
    echo "iptables"
else
    echo "none"
fi

If the output is none, no firewall action is required. Otherwise, run the command for your firewall type:

firewalld

sudo firewall-cmd --permanent --add-port=443/tcp && sudo firewall-cmd --reload

ufw

sudo ufw allow 443/tcp

nftables

sudo nft add table inet filter 2>/dev/null
sudo nft add chain inet filter input '{ type filter hook input priority 0; }' 2>/dev/null
sudo nft add rule inet filter input tcp dport 443 counter accept 2>/dev/null

iptables

sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT

To persist iptables rules after a reboot:

• RHEL/CentOS:

  sudo yum install -y iptables-services
  sudo service iptables save

• Debian/Ubuntu:

  sudo apt-get install -y iptables-persistent
  sudo iptables-save | sudo tee /etc/iptables/rules.v4 >/dev/null

Install the SSL module

Run the following command. If the output is --with-http_ssl_module, the SSL module is already installed and you can skip to Configure the SSL certificate.

nginx -V 2>&1 | grep -o -- '--with-http_ssl_module'

If the system returns nginx: command not found, use the full installation path, for example: /usr/local/nginx/sbin/nginx -V 2>&1 | grep -o -- '--with-http_ssl_module'.

If the SSL module is missing, install it using one of the methods below based on how Nginx was installed.

# Add the official Nginx repository.
sudo tee /etc/yum.repos.d/nginx.repo <<EOF
[nginx-stable]
name=nginx stable repo
baseurl=https://nginx.org/packages/centos/\$releasever/\$basearch/
gpgcheck=1
enabled=1
gpgkey=https://nginx.org/keys/nginx_signing.key
module_hotfixes=true
EOF

# Upgrade Nginx.
sudo yum upgrade nginx

# Upgrade Nginx.
sudo apt-get update
sudo apt-get install --only-upgrade nginx

Configure the SSL certificate

1. Open the configuration file.

   sudo vim /etc/nginx/nginx.conf

2. Add a server block for HTTPS. Copy the existing server block that listens on port 80, change listen 80 to listen 443 ssl, and add the SSL directives shown below. Keep all other settings unchanged.

   # Original server block listening on port 80
   server {
       listen 80;
       server_name yourdomain www.yourdomain;
   
       # Other configurations
       location / {
           proxy_pass http://127.0.0.1:8000;
       }
   }
   
   # New server block for HTTPS.
   server {
       # Change the original 'listen 80' to 'listen 443 ssl'.
       listen 443 ssl;
       # Original server_name. You can add more domain names supported by the current certificate.
       server_name yourdomain www.yourdomain;
   
       # ======================= Start of certificate configuration =======================
       # Specify the certificate file (the intermediate certificate can be appended to this .pem file). Replace /etc/ssl/cert/ssl.pem with the absolute path of your certificate file.
       ssl_certificate /etc/ssl/cert/ssl.pem;
       # Specify the private key file. Replace /etc/ssl/cert/ssl.key with the absolute path of your private key file.
       ssl_certificate_key /etc/ssl/cert/ssl.key;
       # Configure the SSL session cache to improve performance.
       ssl_session_cache shared:SSL:1m;
       # Set the SSL session timeout period.
       ssl_session_timeout 5m;
       # Customize the TLS protocol types and cipher suites to use (the following is an example configuration; evaluate whether you need to configure it).
       ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
       # Specify the allowed TLS protocol versions. Higher TLS versions provide better security for HTTPS communication, but have poorer browser compatibility than lower TLS versions.
       ssl_protocols TLSv1.2 TLSv1.3;
       # Prioritize the cipher suites specified by the server.
       ssl_prefer_server_ciphers on;
       # ======================= End of certificate configuration =======================
   
       # Other configurations
   }

3. (Optional) Redirect HTTP to HTTPS. Add the return directive to the port 80 server block.

   # Original server block listening on port 80
   server {
       listen 80;
       server_name yourdomain www.yourdomain;
   
       # Redirect all HTTP traffic to HTTPS.
       return 301 https://$host$request_uri;
   
       # Other original configurations can be removed as they will no longer be reached.
   }

4. Test the configuration for syntax errors.

   sudo nginx -t -c /etc/nginx/nginx.conf

   If the output includes both syntax is ok and test is successful, the configuration is valid. Otherwise, fix the errors reported and run the test again.

Reload Nginx

sudo nginx -s reload

nginx

Why is HTTPS inaccessible after installation?

Check the following in order:

• Port 443 is blocked — The security group or firewall does not allow inbound traffic on port 443. See Open port 443.

• Domain mismatch — The domain you are accessing is not listed in the certificate's Bound Domains. See the domain coverage table in Prerequisites.

• Nginx not reloaded — The configuration was not reloaded after the changes. Run sudo nginx -s reload.

• Wrong file paths — The ssl_certificate or ssl_certificate_key directives point to incorrect paths. Verify the absolute paths to your .pem and .key files.

• Certificate missing on upstream services — If your domain routes through a Content Delivery Network (CDN), Server Load Balancer (SLB), or Web Application Firewall (WAF), the certificate must be installed on those services as well. See Certificate deployment locations when traffic passes through multiple Alibaba Cloud services.

• Certificate not deployed on all servers — If the domain DNS resolves to multiple servers, install the certificate on each one.

For further help, see Resolve certificate deployment issues based on browser error messages and SSL certificate deployment troubleshooting guide.

How do I update or replace an SSL certificate without downtime?

1. Back up the current .pem and .key files on the server.

2. Download the new certificate and private key from the Certificate Management Service console.

3. Upload the new files to the server, replacing the existing ones. Use the exact same file paths and names that are referenced in your Nginx configuration.

4. Reload Nginx: sudo nginx -s reload.

How can I find the active Nginx configuration file (nginx.conf) on a Linux server?

1. Run ps -ef | grep '[n]ginx: master' | grep -- ' -c '. If the output includes something like -c /etc/nginx/custom.conf, Nginx is using that custom configuration file.

2. If step 1 returns no output, Nginx is using its default compiled path. Run nginx -V 2>&1 | grep -oP -- '--conf-path=[^ ]*' to display the default path, for example --conf-path=/etc/nginx/nginx.conf.

How do I disable TLSv1.0 and TLSv1.1 to fix "certificate does not meet standards" warnings?

Set the ssl_protocols directive in your Nginx configuration to:

ssl_protocols TLSv1.2 TLSv1.3;

This disables the insecure TLSv1.0 and TLSv1.1 protocols. After saving the file, run nginx -s reload to apply the change.

Why does nginx -t fail with bind() to 0.0.0.0:443 failed (98: Address already in use)?

Another process is already listening on port 443. Run sudo ss -tlnp | grep :443 to identify it. Then either stop the conflicting process (such as another web server or a hung Nginx instance) or reconfigure it to use a different port.

Why does nginx -t fail with cannot load certificate "/etc/nginx/ssl/domain.pem": BIO_new_file() failed?

Nginx cannot find the certificate file at the path specified in your configuration. Correct the ssl_certificate directive in nginx.conf to point to the actual absolute path of your .pem file.

Why does reloading Nginx fail with the "ssl" parameter requires ngx_http_ssl_module?

The Nginx build is missing the SSL module. Install or recompile Nginx with ngx_http_ssl_module enabled. See Install the SSL module.

Why do I get No such file or directory: fopen('/cert/3970497_demo.aliyundoc.com.pem','r') when reloading Nginx?

The path specified for ssl_certificate or ssl_certificate_key is incorrect. Verify that the paths in your configuration are correct absolute paths and that the files exist at those locations.

Why does Nginx fail to read the SSL certificate files with a permission denied error?

The Nginx worker process user does not have read access to the certificate files.

1. Find the Nginx worker user: look for the user directive in nginx.conf (for example, user nginx;).

2. Grant that user read (r) permission on the certificate and private key files, and execute (x) permission on all parent directories in the path.