Linux Labs
Linux Labs
EN

Web stack / Stage 5 of 9

HTTPS in nginx: chain and redirect

Not running Starting usually ~20 s
Leave the lesson

Step 3 of 7 · on a machine · 7 min

A full chain file

nginx sends the client everything in the ssl_certificate file — that is where the chain goes.

HTTPS in nginx takes three lines in a server block:

nginx 
listen 443 ssl;
ssl_certificate     /etc/nginx/tls/app.crt;
ssl_certificate_key /etc/nginx/tls/app.key;

listen 443 ssl is port 443 with TLS on it, ssl_certificate is the certificate file, and ssl_certificate_key is its private key.

A certificate in a file is written as PEM text — a block from -----BEGIN CERTIFICATE----- to -----END CERTIFICATE-----. A full chain file is such blocks one after another: the site certificate first, then the intermediate. The root does not go into the file: the client already has it. nginx matches the key from ssl_certificate_key against the first certificate in the file.

cat joins the file, and sudo tee writes it to /etc/nginx/tls, where only root can write — >/dev/null hides the copy tee prints to the screen:

bash 
cat site.crt lab-issuing-ca.crt | sudo tee site-fullchain.crt >/dev/null

From there it is like any nginx edit: the new file's path in ssl_certificate, sudo nginx -t and sudo systemctl reload nginx. reload returns before the new nginx processes start answering, so run the check as a separate command.

Exercise · do it

Serve the whole chain

Make nginx serve the site's certificate together with the intermediate one, /etc/nginx/tls/lab-issuing-ca.crt, for app.lab.test. The site's configuration is /etc/nginx/sites-available/app, the certificates are in /etc/nginx/tls.

Sign in and start The machine is available after signing in

Goals · 0 of 2

  • Build a chain file and point nginx to it
  • Open app.lab.test over HTTPS without an error
Check yourself 1 question

A colleague built the chain file in reverse order — cat lab-issuing-ca.crt app.crt — and pointed ssl_certificate to it. What will sudo nginx -t answer?

  • It never gets to curl: nginx -t rejects the file — the site's key does not match the first certificate, Lab Issuing CA.

  • nginx matches the key from ssl_certificate_key against the file's first certificate. Lab Issuing CA comes first, while the key belongs to the site.

nginx checks the key against the file's first certificate, which is why the site's certificate goes first.

Found an inaccuracy? Report an error in the lesson

Step goals

0 of 2
  • Build a chain file and point nginx to it
  • Open app.lab.test over HTTPS without an error
Ubuntu 24.04

Step goals

0 of 2
  • Build a chain file and point nginx to it
  • Open app.lab.test over HTTPS without an error
Loading…