Self-service installation

Nginx

Choose: Apache / Nginx — PEM ZIP with encrypted private key

Prefer automatic replacement? Set up automatic renewal for supported Nginx configurations. These written steps and videos remain the manual-installation fallback.

Before you start

• Confirm you administer this server and can restore its current configuration.
• Check the certificate is production-issued, unexpired and covers every intended hostname.
• Check DNS points to the intended server, including any IPv6, proxy or CDN path. A certificate does not change DNS.
• Download the matching package; store it outside the web root and keep its password separately.

These examples target a conventional Linux server with OpenSSL and an existing Nginx installation. Use administrator access, your distribution's service names and the required TLS module/listener. A hosting panel may require a different workflow.

Watch a recorded installation

Recorded scripted terminal session on an isolated demo server. Every displayed operation was executed. Silent, with English captions. Pause or use full screen to read commands. Disposable .test certificates are not publicly trusted; use your own hostnames and normal public trust in production. Passwords and MFA are supplied privately and are not shown.

Read the recorded transcript · Watch the quick slide overview

Jump to a chapter

1. 00:00 Confirm the server and scope
2. 00:09 Choose and protect the PEM ZIP
3. 00:23 Prepare a restricted server key
4. 00:45 Update only the intended TLS site
5. 01:02 Verify HTTPS and the control site
6. 01:22 Install a renewed certificate
7. 01:53 Prove rollback remains available
8. 02:09 Restore renewal and finish verification

Chapters are ready when video metadata loads.

Install step by step

1. Download the production PEM ZIP with fresh MFA and a new package password. Back up the existing server block. Securely transfer and extract the package outside the public web directory.

2. Use fullchain.pem as the certificate file. Keep the certificate first in the chain. The encrypted private key must match that certificate; do not mix files from different requests or renewal packages.

3. Prepare the server key locally using OpenSSL and the package password at its prompt. Restrict the output directory and key to the administrator and required service identity (commonly root-owned mode 700/600 for a root-started Linux service). The converted key is unencrypted and must stay protected. Alternatively use Nginx's protected encrypted-key password-file mechanism according to its documentation.

4. Update only the intended server block: listen on 443 with ssl, keep the exact server_name values and point ssl_certificate and ssl_certificate_key at the matching protected files. Preserve existing application locations, upstreams, other sites and security settings.

5. Run nginx -t and fix errors before a graceful nginx -s reload or the distribution's service reload. Keep the previous working configuration available for rollback. Do not deploy the illustrative server block as a replacement for your real application configuration.

6. Verify each public HTTPS name, page, trust chain, expiry and fingerprint from another device. Certificate issuance or download does not prove deployment. Repeat the file replacement and reload for renewals; request a separate quote if you want hands-on installation.

Illustrative configuration

Use your own paths and hostnames. Preserve the rest of your existing configuration.

umask 077
openssl pkey -in private-key.encrypted.pem -out private-key.pem
# Keep the resulting unencrypted key in a restricted directory with mode 600.

# Within your existing server block:
listen 443 ssl;
server_name example.com www.example.com;
ssl_certificate /etc/rymariscerts/example.com/fullchain.pem;
ssl_certificate_key /etc/rymariscerts/example.com/private-key.pem;

nginx -t
# Only after a successful check:
nginx -s reload

Verify before calling it done

• Use another device to open every intended HTTPS hostname without bypassing certificate warnings.
• Check the correct website loads and the served certificate has the expected names, expiry and SHA-256 fingerprint.
• Check apex and www independently. A wildcard does not automatically include the apex.
• Confirm unrelated sites still work. Keep rollback material protected until checks pass.

Troubleshooting

Replacing an expiring certificate? Use the renewal checklist. Need assistance? Request a separate quote.

Official references

• https://nginx.org/en/docs/http/configuring_https_servers.html
• https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_password_file
• https://docs.openssl.org/master/man1/openssl-pkey/

All installation guides · Your certificates