How To Set Up SSL Vhosts Under Nginx + SNI Support (Ubuntu 11.04/Debian Squeeze)

Version 1.0
Author: Falko Timme
Follow me on Twitter

This article explains how you can set up SSL vhosts under nginx on Ubuntu 11.04 and Debian Squeeze so that you can access the vhost over HTTPS (port 443). SSL is short for Secure Sockets Layer and is a cryptographic protocol that provides security for communications over networks by encrypting segments of network connections at the transport layer end-to-end. In addition to that I will show how to make use of SNI (Server Name Indication) to allow multiple SSL vhosts per IP address.

This document comes without warranty of any kind! I do not issue any guarantee that this will work for you!

1 Preliminary Note

I'm assuming that you have a working nginx setup on your Ubuntu 11.04 or Debian Squeeze box, as shown in these tutorials:

I will set up SSL for my vhost www.hostmauritius.com in this tutorial - hostmauritius.com is a domain that I own - replace it with your own domain. I will show how to use a self-signed certificate (this will result in a browser warning when you access https://www.hostmauritius.com) and how to get a certificate from a trusted certificate authority (CA) such as Verisign, Thawte, Comodo, etc. - with a certificate from a trusted CA, your visitors won't see any browser warnings, as is the case with a self-signed certificate. I will use a certificate from CAcert.org - these certificates are free, but are not recognized by all browsers, but it should give you the idea how to install a certificate from a trusted CA.

Traditionally it was not possible to have more than one SSL vhosts per IP address. This has changed with the rise of SNI (Server Name Indication). I will show how to set up a second SSL vhost (www.hostmauritius.net which I own as well) on the same IP address as www.hostmauritius.com with the help of SNI. Please note that currently SNI is not supported by all browsers/operating systems:

Browsers/clients with support for TLS server name indication:

Opera 8.0 and later (the TLS 1.1 protocol must be enabled)
Internet Explorer 7 or later (under Windows Vista and later only, not under Windows XP)
Firefox 2.0 or later
Curl 7.18.1 or later (when compiled against an SSL/TLS toolkit with SNI support)
Chrome 6.0 or later (on all platforms - releases up to 5.0 only on specific OS versions)
Safari 3.0 or later (under OS X 10.5.6 or later and under Windows Vista and later)

To find out if your browser supports SNI, you can go to https://alice.sni.velox.ch/.

I'm running all the steps in this tutorial with root privileges, so make sure you're logged in as root. On Ubuntu, run

sudo su

to become the root user.

2 Determine Your Nginx Version

First you should find out about your nginx version because there are slight differences in SSL configuration for version < 0.8.21 and versions >= 0.8.21.

nginx -v

On Ubuntu 11.04, you should have nginx 0.8.54:

root@server1:~# nginx -v
nginx version: nginx/0.8.54
root@server1:~#

On Debian Squeeze, it's nginx 0.7.67:

root@server1:~# nginx -v
nginx version: nginx/0.7.67
root@server1:~#

3 Setting Up The Vhost

I will now create the vhost www.hostmauritius.com with the document root /var/www/www.hostmauritius.com/web. First I create that directory:

mkdir -p /var/www/www.hostmauritius.com/web

Create a simple nginx vhost configuration for http (port 80):

vi /etc/nginx/sites-available/www.hostmauritius.com.vhost

server {
        listen   80; ## listen for ipv4
        listen   [::]:80; ## listen for ipv6

        server_name  www.hostmauritius.com hostmauritius.com;
        root /var/www/www.hostmauritius.com/web;

        if ($http_host != "www.hostmauritius.com") {
                 rewrite ^ http://www.hostmauritius.com$request_uri permanent;
        }

        location / {
                index  index.php index.html index.htm;
        }

        location ~ \.php$ {
                fastcgi_pass   127.0.0.1:9000;
                fastcgi_index  index.php;
                fastcgi_param  SCRIPT_FILENAME  /var/www$fastcgi_script_name;
                include         fastcgi_params;
        }

        location ~ /\. {
                deny  all;
        }
}

Enable the vhost and reload nginx:

cd /etc/nginx/sites-enabled/
ln -s /etc/nginx/sites-available/www.hostmauritius.com.vhost www.hostmauritius.com.vhost
/etc/init.d/nginx reload

4 Creating A Self-Signed Certificate

Before we set up our SSL vhost, we need an SSL certificate. I will now show you how to create your own self-signed certificate. With this certificate, you will get browser warnings, but this certificate is required to get a trusted certificate from a trusted CA later on.

Make sure that the package ssl-cert is installed:

apt-get install ssl-cert

You can now create a self-signed certificate for www.hostmauritius.com as follows:

make-ssl-cert /usr/share/ssl-cert/ssleay.cnf /etc/ssl/private/www.hostmauritius.com.crt

You will be asked for the hostname:

Host name: <-- www.hostmauritius.com

This will create the self-signed certificate and the private key in one file, /etc/ssl/private/www.hostmauritius.com.crt:

cat /etc/ssl/private/www.hostmauritius.com.crt

I will now split up that file in two, the private key /etc/ssl/private/www.hostmauritius.com.key and the self-signed certificate /etc/ssl/certs/www.hostmauritius.com.pem:

vi /etc/ssl/private/www.hostmauritius.com.key

This file must contain the part beginning with -----BEGIN RSA PRIVATE KEY----- and ending with -----END RSA PRIVATE KEY-----:

The key must be readable and writable by root only:

chmod 600 /etc/ssl/private/www.hostmauritius.com.key

vi /etc/ssl/certs/www.hostmauritius.com.pem

This file must contain the part beginning with -----BEGIN CERTIFICATE----- and ending with -----END CERTIFICATE-----:

Now we can delete the /etc/ssl/private/www.hostmauritius.com.crt file:

rm -f /etc/ssl/private/www.hostmauritius.com.crt

Log in or Sign up

On this page