- \n
- A server with Ubuntu 24.04<\/a> as OS<\/li>\n\n\n\n
- User privileges: root or non-root user with sudo privileges<\/li>\n<\/ul>\n\n\n\n
Step 1. Update the System<\/h2>\n\n\n\n
Before we start with any installation we will update the system packages to their latest versions available:<\/p>\n\n\n\n
sudo apt update -y && sudo apt upgrade -y<\/pre>\n\n\n\n
Step 2. Install Nginx Web Server<\/h2>\n\n\n\n
To install the Nginx Web server execute the following command:<\/p>\n\n\n\n
sudo apt install nginx -y<\/pre>\n\n\n\n
Once installed, start and enable the nginx service:<\/p>\n\n\n\n
sudo systemctl start nginx && sudo systemctl enable nginx<\/pre>\n\n\n\n
To check the status of the Nginx service execute the command below:<\/p>\n\n\n\n
sudo systemctl status nginx<\/pre>\n\n\n\n
You should get the following output:<\/p>\n\n\n\n
root@host:~# sudo systemctl status nginx\n\u25cf nginx.service - A high performance web server and a reverse proxy server\n Loaded: loaded (\/usr\/lib\/systemd\/system\/nginx.service; enabled; preset: enabled)\n Active: active (running) since Sat 2025-01-04 12:38:14 CST; 1min 25s ago\n Docs: man:nginx(8)\n Main PID: 259829 (nginx)\n Tasks: 4 (limit: 4613)\n Memory: 3.0M (peak: 3.5M)\n CPU: 43ms\n CGroup: \/system.slice\/nginx.service\n<\/pre>\n\n\n\n
Step 3.Install OpenSSL<\/h2>\n\n\n\n
OpenSSL is a robust cryptography toolkit that implements the TLS and SSL layers, for encrypted application communication. We need OpenSSL to create the self-signed key and certificate. To install it execute the following command:<\/p>\n\n\n\n
sudo apt install openssl -y<\/pre>\n\n\n\n
Once installed you can check the version with the command below:<\/p>\n\n\n\n
openssl version<\/pre>\n\n\n\n
You should get output similar to this:<\/p>\n\n\n\n
root@host:~# openssl version\nOpenSSL 3.0.13 30 Jan 2024 (Library: OpenSSL 3.0.13 30 Jan 2024)\n<\/pre>\n\n\n\n
Step 4. Create Self-Signed Key and Certificate Pair<\/h2>\n\n\n\n
Now, when the OpenSSL toolkit is installed we can generate an SSL private key and certificate with the following command:<\/p>\n\n\n\n
sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout \/etc\/ssl\/private\/nginx-private.key -out \/etc\/ssl\/certs\/nginx-certificate.crt<\/pre>\n\n\n\n
Once, you execute this command you will be asked for some info about the country, organization name, common name, email, etc. Please note that the most important info in this will be the Common Name<\/strong>, and that is the domain name or your server IP address where the certificate should be issued. In this post we will use the server IP address so out filled info will look like this:<\/p>\n\n\n\n
Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:YourDomainNameHere<\/strong>
Email Address []:admin@yourdomain.com
<\/pre>\n\n\n\nThe private key and the self-signed certificate will be created in the following path we defined in the openssl command:<\/p>\n\n\n\n
The SSL private key: \/etc\/ssl\/private\/nginx-private.key<\/strong>
The Self-Signed certificate: \/etc\/ssl\/certs\/nginx-certificate.crt<\/strong>
<\/pre>\n\n\n\nTo check the content of the generated private key you can execute the following command:<\/p>\n\n\n\n
cat \/etc\/ssl\/private\/nginx-private.key<\/pre>\n\n\n\n
You will get output similar to this:<\/p>\n\n\n\n
-----BEGIN PRIVATE KEY-----\nMIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDLcy5xcNjL6BUN\nMkDmMQEwbgCevSXv+stw4KTHQ26GcP9LDrZhF2dF56f+pBzsk4xtBabk66ZlJr1Q\nWLt1SQLR3kdyRB\/N62JPAewMKJo8JxDcI+XQiXKY0pCBUl\/Ha4b\/HabkzHuS2Equ\nrKrKgr0iA78bWrQS6ag4wN\/+k5weFL3WyKWBeYD\/RCfC\/zC26lLGhs9GTQRwh675\nu+VqtR6N3215JCRuYOg3WQHApkktuo61SR56dHUOjSlZi5+eg2D42SZUR\/ELp23F\ndcmBkwCd0\/4Na2Z+67+n85zS+zdgZsPNADnGo2GiU7iGWLsyVMG71IX7jZJ0jK0R\nDEuVYuQNAgMBAAECggEAGai1t031scXb\/dWUNNQCY+LDxkFxyvH0\/Y\/\/iDgbdO5E\nbGl3HAixGDJu0CFPmpDDWa6oTV\/hFQnNP5hpUBH8vo5LsYAhCL4CoJdL936ZcTO2\nHyWR4vqqztZjrkO+265WkM9jEKEvhqYryRry0WaqxuL1E9SdOHNqqXm95mQkgPCA\nDmIZbMNv31nuKT7W0GDhoYpk11YmZTrOnVsF8bkGAdJxXxeKQK12SUW0Ph6rMXYV\n4q106NUC9n3D6Rnxa1ECFCdANm0v7yC0\/Um61PxDmk\/0F7v1EFwo6IFeqUMzR2Fg\n2\/PEMkYqrD2Jc8UfZyDvbehnmNF1ZWDeDlSYx3CYawKBgQDzoxKcJ4vdUA7Cj7OZ\neT9DivY93502+bKZdrO+\/ad2p0WtC8GIOoYUHdblk+OwSJAPh6yxs\/FlcTuH05K\/\nbgS60kmT0JmzpVF9HCXBz3HMVqH+FrFxF7lzfBJoeQFzcV+Zrf9c46+l8SZMF4yy\no3bMROvv6VpyX7Zhp4iN8Nub7wKBgQDVxhCiypf3YKteIh8JGmaAn75FX3hywCcO\neeQK9ir6taKegwGoIrSAa9UZcHPTUe5yVQMwC7DMNCFpELdefFUKjqXcZJJ+Pt9z\n3\/i7P\/6XE6ft2tGolRsPZiUm87HM5cseH+nEvhWCiTOQyNiaThgHnncOyyHp5pZq\nqCqdeh2zwwKBgQDFrzOScKQT1rmjNGZNyQuECmTyn1Y5HTHFQ4NlHPucUu0+E6Pc\nnV\/dQrjzXqQIjVgWwcdmCNN9s\/rRouIXYXWFAMuinEeadDFCimw4bdGwMzsNp+wi\nD1XyVmG5UzXSLdOcJoplHHmQ87JXW2RWLjxeUi3+ZCF3XCHn6r\/qK9yFEQKBgEDH\nEvVxdJk2htcweb0Vbegd\/9cftez3wx4E25BixeVQsuVbh13+njmn81wRElf\/pMSq\ndBvT\/w\/x4AnpUddkz5QyY5okM6vju2xuev2qx6faAfH2c7+k5x1Ec4+ZGtCe9Wy8\neObwPq5eiuydn90qOufcIfGupiktgXjyWm97uJJnAoGBAN0MKbazEc3BVXthLoPn\nUsnMZlnH1cSx+IoYlzD2Ol9Ws4oFGgy9NjeC66ilcb4Y87BpVVmSqfMJiitI9CCt\nnvyXVuJ+C6o8HIc3AW4sECmlorUgO1wWiFoDd6el862joJsq7hMCzeWDVi6HkhpR\nt1Nvol95VuULK9rrsigTtQ82\n-----END PRIVATE KEY-----\n\n<\/pre>\n\n\n\n
To check the content of the generated certificate file you can execute the following command:<\/p>\n\n\n\n
cat \/etc\/ssl\/certs\/nginx-certificate.crt<\/pre>\n\n\n\n
You should get the following output:<\/p>\n\n\n\n
-----BEGIN CERTIFICATE-----\nMIID5zCCAs+gAwIBAgIUDJeSvnCIHNpKi7Pd0vJtJqISZ\/swDQYJKoZIhvcNAQEL\nBQAwgYIxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQK\nDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQxFjAUBgNVBAMMDTE2Mi4yNDYuMjU0\nLjMxIzAhBgkqhkiG9w0BCQEWFGFkbWluQHlvdXJkb21haW4uY29tMB4XDTI1MDEw\nMzE5MDAxNloXDTI2MDEwMzE5MDAxNlowgYIxCzAJBgNVBAYTAkFVMRMwEQYDVQQI\nDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQx\nFjAUBgNVBAMMDTE2Mi4yNDYuMjU0LjMxIzAhBgkqhkiG9w0BCQEWFGFkbWluQHlv\ndXJkb21haW4uY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAy3Mu\ncXDYy+gVDTJA5jEBMG4Anr0l7\/rLcOCkx0NuhnD\/Sw62YRdnReen\/qQc7JOMbQWm\n5OumZSa9UFi7dUkC0d5HckQfzetiTwHsDCiaPCcQ3CPl0IlymNKQgVJfx2uG\/x2m\n5Mx7kthKrqyqyoK9IgO\/G1q0EumoOMDf\/pOcHhS91silgXmA\/0Qnwv8wtupSxobP\nRk0EcIeu+bvlarUejd9teSQkbmDoN1kBwKZJLbqOtUkeenR1Do0pWYufnoNg+Nkm\nVEfxC6dtxXXJgZMAndP+DWtmfuu\/p\/Oc0vs3YGbDzQA5xqNholO4hli7MlTBu9SF\n+42SdIytEQxLlWLkDQIDAQABo1MwUTAdBgNVHQ4EFgQUe8ZdqUyBdYSeTGyKKdCc\nzTE7Nj0wHwYDVR0jBBgwFoAUe8ZdqUyBdYSeTGyKKdCczTE7Nj0wDwYDVR0TAQH\/\nBAUwAwEB\/zANBgkqhkiG9w0BAQsFAAOCAQEAAsXXJs6deSbbnkVVZ0McmIaMNj1\/\noxxRtd\/d41wIYsw+WtTz0I7A8fMUROKZRyiwj8j873249vPrQ3R2BXG1mNJ0qfwU\nH9pQJkfB3zYhT1dS9YbsQUEcO2go1+Y8WnIzFtIujJfogEA+c+OLKQTkoith7Cgi\nQBs8s\/xjkzR2ouVMWXrAUI4MnBOAcxFOIkKAyQZBz85V6xsosOFxUZ\/gruzDnmN2\nz96Tejp0PS3Iv0kyzVkxBSumFivIk6qHr5FSlyrWm\/pmpj1uCizvOa1SlEZLJi5n\nBQpnU0fU5PvCOGm\/g895NB\/ZxR4B9wbvjGjhd94aUiVJ7V9S577dbfpZiQ==\n-----END CERTIFICATE-----\n\n<\/pre>\n\n\n\n
Next is to create dhparam<\/strong> which is used to negotiate the perfect forward secrecy policy with clients. To generate dhparam.pem<\/strong> file execute the command below:<\/p>\n\n\n\n
sudo openssl dhparam -out \/etc\/nginx\/dhparam.pem 4096<\/pre>\n\n\n\n
Generating the strong dhparam will take up to 30 minutes. Once created you can check it with the following command:<\/p>\n\n\n\n
cat \/etc\/nginx\/dhparam.pem\n<\/pre>\n\n\n\n
You should receive output similar to this:<\/p>\n\n\n\n
root@host:~# cat \/etc\/nginx\/dhparam.pem\n-----BEGIN DH PARAMETERS-----\nMIICCAKCAgEAhA8SC2VWysEKoDOXiMvCqL0uDv2PWW38gVFCMXtt4UOHd1cWoR0P\nkcoj0BQkGC6ecsRnXF3S9HoV+mDoN6zdSTt69CCGfkDQf5oNhpOvQxUt6qn8A7du\nejkPCsZju2JUGAkINsCEJqzWCIbH1Z9s1at7YSMrdead7AijkvWkcrfMAfJ8EqdD\nchg1MewXgmJFzl7XGsitiICadVDebOn2JY+Y56QnCaa4q1GuRhFX1A9TzJXp8I06\nWLuj+PdiXFNZM8CtXUM0TbiKLqaqODiguq\/hKr3oIOANuSfxzjsPCMo4j66i9v2t\nx2pyQrj7+exK6O8MVm+roqm9upPZCKtyQeXmxQA8n8PsHOoGgjZuvbx38dHbOKfz\ncbNwdSCh85CjxRGttWU2Fh7+QvTdStnxo\/te7gc1L+j4\/Vz+QiKwXsJEA+daLp3o\nJNpuieIosLXI1\/1HsWGF88OBHexlMxNNRvdryek3U1bTOb3KMUW0e6ceI5sTS4l\/\nimwEsc7KQiABKH8s5xtPcgoDbVriB\/\/AJv2WNGDdQLZi2TCxKfo2LenU8efOgtgG\nIV+XF9hHZfp7Mm25g9JNgpdxThN1Ogm8d1b+o4gQQjfM5z1q+6k5YinT9KYUCijm\nQZagXJoM80fVnw8JPPbNKWA9VAKrrJyJiV2vM\/Ky3+Z48n\/ZC+fNRbcCAQI=\n-----END DH PARAMETERS-----\n<\/pre>\n\n\n\n
Step 5. Configure Nginx<\/h2>\n\n\n\n
The last step of the blog post is to configure the Nginx web server to read the generated self-signed certificate<\/strong> along with the private key<\/strong> and dhparam<\/strong>. In other words, we will create configuration snippet for Strong Encryption settings, including the generated dhparam.pem file. Then we will create a a Nginx configuration file, including the SSL certificate file and private key along with the snippet.<\/p>\n\n\n\n
To create the snippet for the strong encryption settings which will include the dhparam:<\/p>\n\n\n\n
touch \/etc\/nginx\/snippets\/ssl-params.conf<\/pre>\n\n\n\n
Open the file with your favorite text editor and paste the following lines of code:<\/p>\n\n\n\n
ssl_protocols TLSv1.3;
ssl_prefer_server_ciphers on;
ssl_dhparam \/etc\/nginx\/dhparam.pem; <\/strong>
ssl_ciphers EECDH+AESGCM:EDH+AESGCM;
ssl_ecdh_curve secp384r1;
ssl_session_timeout 10m;
ssl_session_cache shared:SSL:10m;
ssl_session_tickets off;
ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 5s;
# Disable strict transport security for now. You can uncomment the following
# line if you understand the implications.
#add_header Strict-Transport-Security \"max-age=63072000; includeSubDomains; preload\";
add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection \"1; mode=block\";
<\/pre>\n\n\n\nNext we need to create Nginx configuration for our domain name. To do that execute the following command:<\/p>\n\n\n\n
touch \/etc\/nginx\/sites-available\/your_domain_name-here<\/pre>\n\n\n\n
Open the file and paste the following lines of code:<\/p>\n\n\n\n
server {
root \/var\/www\/html;
index index.php index.html index.htm;
server_name YourDomainNameHere<\/strong>;
error_log \/var\/log\/nginx\/YourDomainNameHere<\/strong>_error.log;
access_log \/var\/log\/nginx\/YourDomainNameHere<\/strong>_access.log;
client_max_body_size 100M;
location \/ {
try_files $uri $uri\/ \/index.php?$args;
}
location ~ \\.php$ {
include snippets\/fastcgi-php.conf;
fastcgi_pass unix:\/run\/php\/php8.3-fpm.sock;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
}
listen 443 ssl;
ssl_certificate \/etc\/ssl\/certs\/nginx-certificate.crt;
ssl_certificate_key \/etc\/ssl\/private\/nginx-private.key;
include \/etc\/nginx\/snippets\/ssl-params.conf;<\/strong>
}
server {
if ($host = YourDomainNameHere<\/strong>) {
return 301 https:\/\/$host$request_uri;
}
listen 80;
server_name YourDomainNameHere<\/strong>;
return 404;
}
<\/pre>\n\n\n\nSave the file and close it.<\/p>\n\n\n\n
Check the Nginx configuration with the following command:<\/p>\n\n\n\n
nginx -t<\/pre>\n\n\n\n
You might get output with a warning about an unknown certificate issuer, which is fine because we create self-signed SSL certificates:<\/p>\n\n\n\n
root@host:\/etc\/nginx# nginx -t\n2025\/01\/04 13:50:32 [warn] 289235#289235: \"ssl_stapling\" ignored, issuer certificate not found for certificate \"\/etc\/ssl\/certs\/nginx-certificate.crt\"\nnginx: the configuration file \/etc\/nginx\/nginx.conf syntax is ok\nnginx: configuration file \/etc\/nginx\/nginx.conf test is successful\n<\/pre>\n\n\n\n
The bottom two lines say that the configuration is OK, and the Nginx test is successful so that we can restart the Nginx service:<\/p>\n\n\n\n
sudo systemctl restart nginx<\/pre>\n\n\n\n
Step 6. Access the website in the Browser<\/h2>\n\n\n\n
The last is to access the website in your browser and to verify that the Self-Signed certificate is working. The first time accessing the website in Chrome will throw the Your connection is not private<\/strong> which is fine since the self-signed certificate is not trusted by the certificate authorities:<\/p>\n\n\n\n
![\"Your](\"https:\/\/www.linuxcloudvps.com\/blog\/wp-content\/uploads\/2025\/01\/im1-1.png\")
<\/a><\/figure>\n\n\n\nClick on Advanced<\/strong>, then Proceed to your website domain (unsafe) to access the website “insecurely”. Remember that this is due to the self-signed certificate.<\/p>\n\n\n\n
![\"Your](\"https:\/\/www.linuxcloudvps.com\/blog\/wp-content\/uploads\/2025\/01\/im2-1.png\")
<\/a><\/figure>\n\n\n\nOnce the website is accessed you need to click left of the URL on Not secure<\/strong> and then on Certificate Details<\/strong>:<\/p>\n\n\n\n
![\"not](\"https:\/\/www.linuxcloudvps.com\/blog\/wp-content\/uploads\/2025\/01\/im3-2.jpg\")
<\/a><\/figure>\n\n\n\nIn the Genereal tab, under the Validity section you will see the validity of the self-signed certificate:<\/p>\n\n\n\n
![\"date](\"https:\/\/www.linuxcloudvps.com\/blog\/wp-content\/uploads\/2025\/01\/im4.jpg\")
<\/a><\/figure>\n\n\n\nIt says that the certificate iss valid for 1 year, which was defined in the command we executed in Step 4.<\/p>\n\n\n\n
sudo openssl req -x509 -nodes -days 365<\/strong> -newkey rsa:2048 -keyout \/etc\/ssl\/private\/nginx-private.key -out \/etc\/ssl\/certs\/nginx-certificate.crt<\/code><\/pre>\n\n\n\nThat’s it! You have learned how to cerate a Self-Signed-SSL-Certificate for Nginx in Ubuntu 24.04 OS.<\/p>\n\n\n\n
PS. If you liked this post about creating a self-signed SSL certificate for Nginx in Ubuntu 24.04 OS, please share it with your friends or leave a reply below. Thanks.<\/p>\n","protected":false},"excerpt":{"rendered":"
- User privileges: root or non-root user with sudo privileges<\/li>\n<\/ul>\n\n\n\n