Click Below to subscribe

How to Install SSL on Nginx Ubuntu Web Server

In this article, we gonna learn, how to install SSL on nginx web server.

Ubuntu Version:- 20.04


1. Create record on DNS records that points to your server.

2. Log into your server via SSH.

ssh root@your_server_ip

3. Update apt and install nginx.

sudo apt update
sudo apt install nginx

4. Enable firewall.

Check firewall status.

sudo ufw status
root@ultimateakash:~# sudo ufw status
Status: inactive

If firewall's status is inactive, activate it by hitting the below command.

sudo ufw enable
root@ultimateakash:~# sudo ufw enable
Command may disrupt existing ssh connections. Proceed with operation (y|n)? y
Firewall is active and enabled on system startup

5. Update ufw application profiles.

List the ufw application profiles.

sudo ufw app list
root@ultimateakash:~# sudo ufw app list
Available applications:
  Nginx Full
  Nginx HTTP
  Nginx HTTPS

These nginx profiles were added during nginx installation.

Allow Nginx Full and OpenSSH profiles.

sudo ufw allow 'Nginx Full'
sudo ufw allow OpenSSH

Check ufw status.

sudo ufw status
root@ultimateakash:~# sudo ufw status
Status: active

To                         Action      From
--                         ------      ----
Nginx Full                 ALLOW       Anywhere
OpenSSH                    ALLOW       Anywhere
Nginx Full (v6)            ALLOW       Anywhere (v6)
OpenSSH (v6)               ALLOW       Anywhere (v6)

6. Check nginx status

sudo systemctl status nginx
root@ultimateakash:~# sudo systemctl status nginx
● nginx.service - A high performance web server and a reverse proxy server
     Loaded: loaded (/lib/systemd/system/nginx.service; enabled; vendor preset: enabled)
     Active: active (running) since Sat 2022-07-09 08:03:56 UTC; 1min 16s ago
       Docs: man:nginx(8)
   Main PID: 9282 (nginx)
      Tasks: 2 (limit: 2339)
     Memory: 3.8M
     CGroup: /system.slice/nginx.service
             ├─9282 nginx: master process /usr/sbin/nginx -g daemon on; master_process on;
             └─9283 nginx: worker process

Open your domain/server IP in the browser. You will see the default nginx installation page(/var/www/html/index.nginx-debian.html ).

Nginx has one server block enabled by default that is configured to serve documents from the /var/www/html directory.  You can use this default block but it's recommended to create domain specific blocks.

7. Setup Server Blocks.

Create the directory for your domain.

sudo mkdir /var/www/

Assign ownership of the directory with the $USER environment variable and grant 775 permission.

sudo chown -R $USER:$USER /var/www/
sudo chmod -R 755 /var/www/

Create a sample index.html

sudo nano /var/www/

Paste this HTML code.

        <h1>Welcome to</h1>

press ctrl + x and press y then hit enter.

Create a config file.

sudo nano /etc/nginx/sites-available/
server {
    listen 80;
    listen [::]:80;

    root /var/www/;
    index index.html index.htm index.nginx-debian.html;


    location / {
        try_files $uri $uri/ =404;

These two lines

root /var/www/your_domain;
server_name your_domain www.your_domain;

press ctrl + x and press y then hit enter.

Enable this new configuration by creating a link from it to the sites-enabled directory.

sudo ln -s /etc/nginx/sites-available/ /etc/nginx/sites-enabled/

Uncomment bucket size.

sudo nano /etc/nginx/nginx.conf

Find server_names_hash_bucket_size directive and remove the # symbol to uncomment the line.

http {

        # Basic Settings

        sendfile on;
        tcp_nopush on;
        tcp_nodelay on;
        keepalive_timeout 65;
        types_hash_max_size 2048;
        # server_tokens off;

        server_names_hash_bucket_size 64;

Test configuration.

sudo nginx -t
root@ultimateakash:~# sudo nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

Reload nginx to implement the changes.

sudo systemctl reload nginx

8. Install SSL certificates.

Install Certbot

sudo apt install certbot python3-certbot-nginx

Obtaining SSL certificates.

sudo certbot --nginx -d -d

you can pass multiple domains with -d option. you can even use wildcards.

-d *

After hitting the above command you need to pass your email also you need to provide a few answers.

Finally, SSL is installed on your nginx server. you can verify it by hitting your domain in the browser.

Let’s Encrypt’s certificates are only valid for 90 days. but don't worry certbot takes care of renewals.

Check certbot's renewal service status.

sudo systemctl status certbot.timer
root@ultimateakash:~# sudo systemctl status certbot.timer
● certbot.timer - Run certbot twice daily
     Loaded: loaded (/lib/systemd/system/certbot.timer; enabled; vendor preset: enabled)
     Active: active (waiting) since Sun 2022-07-03 15:37:21 UTC; 5s ago
    Trigger: Mon 2022-07-04 06:42:10 UTC; 15h left
   Triggers: ● certbot.service

Jul 03 15:37:21 ultimateakash systemd[1]: Started Run certbot twice daily.

Leave Your Comment