How to Install an SSL Certificate on Nginx

To install an SSL certificate on Nginx you need to place the certificate files on the server, edit the server block in Nginx's configuration, and reload the service. The entire process takes under 15 minutes on a standard VPS.

This guide covers installing a commercial (DV, OV, or EV) or Let's Encrypt certificate on Nginx on Linux, including HTTP-to-HTTPS redirection and final verification.

Prerequisites

Before starting, confirm you have:

• SSH access to the server with sudo privileges.
• Nginx installed and running (nginx -v to check).
• A domain pointing to the server's IP (DNS fully propagated).
• Your SSL certificate files: typically domain.crt (or .pem), the private key domain.key, and if applicable, the intermediate certificate (bundle/chain).

If you're using Let's Encrypt, you can skip the certificate files section — Certbot generates and places them automatically.

Option A — Install a Commercial Certificate

Step 1: Upload and Combine the Certificate Files

Copy the files to a secure path on the server:

sudo mkdir -p /etc/nginx/ssl
sudo cp domain.crt /etc/nginx/ssl/
sudo cp domain.key /etc/nginx/ssl/
sudo cp intermediate_chain.crt /etc/nginx/ssl/

Nginx requires the domain certificate and intermediate chain to be concatenated into a single file (full chain certificate):

sudo cat domain.crt intermediate_chain.crt > /etc/nginx/ssl/domain_fullchain.crt

Restrict permissions so only root can read the private key:

sudo chmod 600 /etc/nginx/ssl/domain.key

Step 2: Edit the Server Block in Nginx

Open your site's configuration file (usually at /etc/nginx/sites-available/yourdomain or /etc/nginx/conf.d/yourdomain.conf):

sudo nano /etc/nginx/sites-available/yourdomain

Replace or supplement the existing block with this structure:

server {
    listen 443 ssl http2;
    server_name yourdomain.com www.yourdomain.com;

    ssl_certificate     /etc/nginx/ssl/domain_fullchain.crt;
    ssl_certificate_key /etc/nginx/ssl/domain.key;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 1d;

    root /var/www/yourdomain/public_html;
    index index.php index.html;

    location / {
        try_files $uri $uri/ =404;
    }
}

# Redirect HTTP to HTTPS
server {
    listen 80;
    server_name yourdomain.com www.yourdomain.com;
    return 301 https://$host$request_uri;
}

Step 3: Test and Reload Nginx

sudo nginx -t
sudo systemctl reload nginx

The nginx -t command tests the configuration syntax without interrupting the service. If it shows syntax is ok and test is successful, the reload is safe to proceed.

Option B — Install Let's Encrypt with Certbot

Let's Encrypt is free, widely supported, and self-renewing. It's the ideal option for most websites.

Step 1: Install Certbot

On Debian/Ubuntu-based systems:

sudo apt update
sudo apt install certbot python3-certbot-nginx

On RHEL/CentOS/AlmaLinux systems:

sudo dnf install certbot python3-certbot-nginx

Step 2: Obtain and Install the Certificate

sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com

Certbot automatically edits your Nginx configuration to add the SSL blocks and HTTPS redirect. It also schedules automatic renewal via cron or a systemd timer.

Step 3: Test the Automatic Renewal

sudo certbot renew --dry-run

If no errors appear, your certificate will renew without manual intervention every 60–90 days.

Recommended Security Hardening

Once HTTPS is active, strengthen the SSL configuration with these additional directives:

For more on security headers and how to configure them properly, browse our SSL security section.

Verifying the Installation

After reloading Nginx, verify the installation with these tools:

• SSL Labs: go to ssllabs.com/ssltest/ and enter your domain. An A or A+ result confirms a solid configuration.
• Browser: open https://yourdomain.com and check for the padlock in the address bar.
• curl: from the terminal, curl -I https://yourdomain.com should return 200 OK with no SSL warnings.

If the site still shows mixed content warnings (images or scripts loading over HTTP), check that all internal URLs use https://.

Looking for hosting with SSL included and expert technical support? elenlace.com offers managed plans where we handle certificate installation and renewal for you.

Key Takeaways

• Installing SSL on Nginx requires concatenating the certificate and intermediate chain into a single fullchain file.
• The server block must listen on port 443 with the ssl_certificate and ssl_certificate_key directives.
• Always add a separate block that redirects port 80 (HTTP) to port 443 (HTTPS) with a 301 permanent redirect.
• Let's Encrypt with Certbot is the simplest option: it installs and renews the certificate automatically.
• Validate the result on SSL Labs to confirm there are no vulnerabilities or chain errors.

Need help configuring your server? Contact us and our technical team will install and configure your SSL certificate on Nginx at no additional cost on eligible plans.

FAQ

What is the difference between ssl_certificate and ssl_certificate_key in Nginx?

ssl_certificate points to the public file (certificate + intermediate chain concatenated), while ssl_certificate_key points to the private key generated when you created the CSR. Both files work as a pair: the certificate proves identity, the key decrypts the connection.

Why won't Nginx start after adding SSL?

The most common cause is a syntax error in the configuration file or an incorrect file path. Run sudo nginx -t to see the exact error message. It can also happen if the private key and certificate don't match — they must have been generated together from the same CSR.

Can I use the same SSL certificate with HTTP/2 on Nginx?

Yes. Add http2 to the listen directive (as shown in the example: listen 443 ssl http2;). HTTP/2 requires HTTPS, so you cannot enable it on the port 80 block.

Does Let's Encrypt work on any Nginx server?

It works on any publicly accessible server where the domain resolves to the correct IP. It does not work on local servers or private IPs unless you use the DNS-01 challenge validation method with Certbot.

Useful resources

Other providers and guides worth comparing:

• HostGator México
• Hostinger
• HubSpot