Linux Labs
Linux Labs
EN

Web stack / Stage 5 of 9

HTTPS in nginx: chain and redirect

Not running Starting usually ~20 s
Leave the lesson

Step 1 of 7 · on a machine · 5 min

The root is there, yet curl does not trust

What you will learn

  • Tell from the s_client output which link of the chain the client is missing.
  • Turn on HTTPS in nginx with a full chain file.
  • Send requests from HTTP to HTTPS with the same path.

The site app.lab.test got a new certificate, and nginx already serves it over HTTPS. The root Lab Root CA, just as in the previous lesson, is in the machine's trust store. Check the site and see who issued its certificate.

Exercise · look

Request app.lab.test

Request the home page https://app.lab.test/ and see who issued the site's certificate — the file /etc/nginx/tls/app.crt.

First, predict

What will curl print?

Now start the exercise, run the command and compare your prediction with the output.

Sign in and start The machine is available after signing in
Check yourself 1 question

Lab Root CA is in the trust store, yet curl says unable to get local issuer certificate. Why?

  • It was: ls /usr/local/share/ca-certificates shows lab-root-ca.crt. The root is in place — the link between it and the site is missing.

  • About expiry, curl says certificate has expired. openssl x509 -in /etc/nginx/tls/app.crt -noout -dates shows the certificate is within its validity.

  • Without nginx, curl would print Couldn't connect to server. It received a certificate, so nginx answered.

Between the site's certificate and the root in the store, one link is missing — Lab Issuing CA.

Found an inaccuracy? Report an error in the lesson

Ubuntu 24.04
Loading…