RymarisCerts NGINX recorded installation walkthrough
This is a genuine scripted terminal/PowerShell session on an isolated demo server.
All displayed operations were executed. No production certificates, passwords, MFA,
or private-key contents are included. Lab .test hostnames and explicit-root checks
must be replaced with your own hostnames and normal public trust in production.
Passwords were supplied privately before recording. On your server enter package
passwords locally;never put them into commands,source files,or website configuration.
00:00:00.000 Chapter 1: Confirm the server and scope
00:00:09.012 Chapter 2: Choose and protect the PEM ZIP
00:00:23.020 Chapter 3: Prepare a restricted server key
00:00:45.041 Chapter 4: Update only the intended TLS site
00:01:02.100 Chapter 5: Verify HTTPS and the control site
00:01:22.138 Chapter 6: Install a renewed certificate
00:01:53.219 Chapter 7: Prove rollback remains available
00:02:09.287 Chapter 8: Restore renewal and finish verification
RECORDED COMMANDS AND OUTPUT
RymarisCerts | nginx certificate installation
CHAPTER 1 | Confirm the server and scope
Recorded on a prepared Ubuntu lab;commands below run on the real server.
Disposable .test certificates are NOT publicly trusted.
No passwords,private-key contents or MFA are recorded.
$ nginx -v
nginx version: nginx/1.24.0 (Ubuntu)
RymarisCerts | nginx certificate installation
CHAPTER 2 | Choose and protect the PEM ZIP
$ printf "Package folder: %s\n" "$PKG"
Package folder: /opt/rymariscerts-demo/packages/nginx/initial
$ unzip -l "$base/packages/$server/initial.zip"
Archive: /opt/rymariscerts-demo/packages/nginx/initial.zip
Length Date Time Name
--------- ---------- ----- ----
1619 2026-11-13 15:49 certificate.pem
3185 2026-11-13 15:49 fullchain.pem
2654 2026-11-13 15:49 private-key.encrypted.pem
93 2026-11-13 15:49 README.txt
--------- -------
7551 4 files
Use certificate.pem,fullchain.pem,and private-key.encrypted.pem.
The package password was supplied privately before recording.
Never place keys in the public website directory.
RymarisCerts | nginx certificate installation
CHAPTER 3 | Prepare a restricted server key
$ umask 077
$ mkdir -p "$DEST"
$ openssl pkey -in "$PKG/private-key.encrypted.pem" -passin env:RYMARIS_INITIAL_PACKAGE_PASSWORD -out "$DEST/private-key.pem"
$ install -m 644 "$PKG/fullchain.pem" "$DEST/fullchain.pem"
$ stat -c "%U %a %n" "$DEST/private-key.pem"
root 600 /etc/rymariscerts-demo/nginx/video-take-20261113-160725/initial/private-key.pem
The passphrase variable is temporary and is not shown or saved in configuration.
RymarisCerts | nginx certificate installation
CHAPTER 4 | Update only the intended TLS site
$ cp -p "$SITE" "$take/$server-original-site.conf"
$ sed -i -E "s@^[[:space:]]*ssl_certificate .*@ ssl_certificate $DEST/fullchain.pem;@;s@^[[:space:]]*ssl_certificate_key .*@ ssl_certificate_key $DEST/private-key.pem;@" "$SITE"
$ cat "$SITE"
server {
listen 127.0.0.1:8443 ssl;
server_name nginx.rymariscerts.test;
root /var/www/rymariscerts-demo/nginx/target;
index index.html;
ssl_certificate /etc/rymariscerts-demo/nginx/video-take-20261113-160725/initial/fullchain.pem;
ssl_certificate_key /etc/rymariscerts-demo/nginx/video-take-20261113-160725/initial/private-key.pem;
}
$ nginx -t && systemctl reload nginx
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
RymarisCerts | nginx certificate installation
CHAPTER 5 | Verify HTTPS and the control site
$ curl --fail --cacert "$CA" --resolve "$HOST:$port:127.0.0.1" "https://$HOST:$port/"
RymarisCerts nginx HTTPS demoRymarisCerts nginx HTTPS demo
Disposable lab certificates only.
$ printf "\n" | openssl s_client -connect "127.0.0.1:$port" -servername "$HOST" -CAfile "$CA" -verify_return_error 2>/dev/null | openssl x509 -noout -subject -enddate -fingerprint -sha256
subject=CN = nginx.rymariscerts.test
notAfter=Dec 13 15:49:53 2026 GMT
sha256 Fingerprint=21:E9:FA:58:C9:60:93:10:B3:98:1C:CC:61:6B:CC:42:C8:55:62:C4:CE:99:A0:A2:02:42:2B:20:D8:05:6E:65
$ curl --fail --resolve "control.$server.rymariscerts.test:$control:127.0.0.1" "http://control.$server.rymariscerts.test:$control/"
RymarisCerts nginx controlRymarisCerts nginx control site
$ cp -p "$SITE" "$BACKUP"
--cacert and --resolve are lab-only here. For production,verify public DNS
and normal browser trust from another device.
RymarisCerts | nginx certificate installation
CHAPTER 6 | Install a renewed certificate
$ printf "Renewal package: %s\n" "$PKG"
Renewal package: /opt/rymariscerts-demo/packages/nginx/renewed
$ mkdir -p "$DEST"
$ openssl pkey -in "$PKG/private-key.encrypted.pem" -passin env:RYMARIS_RENEWED_PACKAGE_PASSWORD -out "$DEST/private-key.pem"
$ install -m 644 "$PKG/fullchain.pem" "$DEST/fullchain.pem"
$ sed -i -E "s@^[[:space:]]*ssl_certificate .*@ ssl_certificate $DEST/fullchain.pem;@;s@^[[:space:]]*ssl_certificate_key .*@ ssl_certificate_key $DEST/private-key.pem;@" "$SITE"
$ nginx -t && systemctl reload nginx
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
$ printf "\n" | openssl s_client -connect "127.0.0.1:$port" -servername "$HOST" -CAfile "$CA" -verify_return_error 2>/dev/null | openssl x509 -noout -enddate -fingerprint -sha256
notAfter=Jan 12 15:49:53 2027 GMT
sha256 Fingerprint=62:37:92:51:3E:14:C4:AF:53:7C:BB:76:99:5B:A3:B4:E6:76:85:65:35:B7:EA:9F:3F:60:9C:E0:43:CA:45:09
$ cp -p "$SITE" "$RENEWED"
The renewal has a later expiry and a different served fingerprint.
A fresh package password was supplied privately.
RymarisCerts | nginx certificate installation
CHAPTER 7 | Prove rollback remains available
$ cp -p "$BACKUP" "$SITE"
$ nginx -t && systemctl reload nginx
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
$ printf "\n" | openssl s_client -connect "127.0.0.1:$port" -servername "$HOST" -CAfile "$CA" -verify_return_error 2>/dev/null | openssl x509 -noout -enddate -fingerprint -sha256
notAfter=Dec 13 15:49:53 2026 GMT
sha256 Fingerprint=21:E9:FA:58:C9:60:93:10:B3:98:1C:CC:61:6B:CC:42:C8:55:62:C4:CE:99:A0:A2:02:42:2B:20:D8:05:6E:65
Rollback restored the initial certificate. Keep the old protected package
until installation and external checks pass.
RymarisCerts | nginx certificate installation
CHAPTER 8 | Restore renewal and finish verification
$ cp -p "$RENEWED" "$SITE"
$ nginx -t && systemctl reload nginx
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
$ curl --fail --cacert "$CA" --resolve "$HOST:$port:127.0.0.1" "https://$HOST:$port/"
RymarisCerts nginx HTTPS demoRymarisCerts nginx HTTPS demo
Disposable lab certificates only.
$ curl --fail --resolve "control.$server.rymariscerts.test:$control:127.0.0.1" "http://control.$server.rymariscerts.test:$control/"
RymarisCerts nginx controlRymarisCerts nginx control site
Renewed certificate active;control site still responds.
Downloading a renewal alone does not install it.
Repeat validation for every real hostname and server.
PASSWORD INPUT NOTE
The two passphrase environment variables in this recorded automation were supplied
privately and removed afterward. For an interactive install,omit -passin and enter
the package password at the OpenSSL prompt. Use a fresh password for each package.