Namecheap SSL + Nginx Configuration
I followed this tutorial to set up my SSL certificate on verysuchmuch.com.
The formatting made it a little difficult to read so I decided to repost and explain the steps myself. In the following comands, replace "example.com" with your domain name.
openssl genrsa -des3 -out example.com.key 2048
openssl rsa -in example.com.key -out example.com.key.nopass
openssl req -new -key example.com.key.nopass -out example.com.csr
Here you'll be prompted to enter some information about your site. All questions marked with '[]' are optional, however, 'Common Name' must be the same as your domain name. Also, don't enter a Challenge Password.
Now, navigate to the Your SSL Certificates page of your Namecheap account. Select 'Activate Now' on your certificate.
Select server type: Apache/OpenSSL*
Copy the entire contents of example.com.csr into the text area, this includes the -----BEGIN---- and ----END--- tags.
Enter the additional information Namecheap asks for and submit the form.
After 30 minutes to a few hours, You'll receive an email with a zip file containing 3 files. Unzip the file, and then open a terminal in the directory where you placed them.
cat example_com.crt PositiveSSLCA2.crt AddTrustExternalCARoot.crt > example.com.crt
Copy example.com.crt and example.com.key.nopass to a place on your server where nginx can access them. For me, I chose: /usr/local/etc/nginx/ssl/
In your nginx configuration for example.com place:
ssl on;
ssl_certificate /usr/local/etc/nginx/ssl/example.com.crt;
ssl_certificate_key /usr/local/etc/nginx/ssl/example.com.key.nopass;
You should be set to restart nginx and be certified! (sudo service nginx restart)
I didn't have https set up prior to purchasing a certificate, so I needed a new server {} block in my configuration listening on port 443 instead of 80.
server {
listen 0.0.0.0:443;
ssl on;
ssl_certificate /usr/local/etc/nginx/ssl/example.com.crt;
ssl_certificate_key /usr/local/etc/nginx/ssl/example.com.key.nopass;
server_name example.com;
access_log /var/log/nginx/example.access.log;
location / {
# redacted
}
To force people that hit example.com on regular http over port 80:
server {
listen 0.0.0.0:80;
server_name example.com;
access_log /var/log/nginx/example.access.log;
return 301 https://example.com;
*This selection is okay. as the server architectures handle ssl in very similar manners.