This guide explains how to install an SSL certificate issued through ClouDNS on an Nginx web server. The instructions cover Actalis, RapidSSL, and Sectigo certificates, including the intermediate certificates required to serve a complete certificate chain.
Download your SSL certificate from the ClouDNS web panel. The certificate file will typically be named:
your-domain.com.crt |
Nginx must also serve the correct intermediate certificate chain. Select the Certificate Authority (CA) that issued your SSL certificate to view its download and installation instructions.
After creating |
Create a directory where Nginx will read the certificate files. For example:
sudo mkdir -p /etc/nginx/ssl/example_com/Move the full certificate chain created in Step 1 into this directory:
sudo mv your-domain.com.fullchain.pem /etc/nginx/ssl/example_com/Move the private key generated when the Certificate Signing Request (CSR) was created to the same directory, or another secure location accessible to Nginx.
sudo mv example_com.key /etc/nginx/ssl/example_com/Restrict access to the private key. On a typical Linux installation, you can set its ownership and permissions as follows:
sudo chown root:root /etc/nginx/ssl/example_com/example_com.key
sudo chmod 600 /etc/nginx/ssl/example_com/example_com.key| Security
The private key must match the domain certificate. Do not upload it to a public web directory or share it with unauthorized users. If Nginx runs under a nonstandard user account, make sure its master process can access the key. |
Open the Nginx configuration file for your website. Configure ssl_certificate to use the full certificate chain and ssl_certificate_key to use the corresponding private key.
Example HTTPS server block:
server {
listen 443 ssl;
server_name domainname.com;
ssl_certificate /etc/nginx/ssl/example_com/your-domain.com.fullchain.pem;
ssl_certificate_key /etc/nginx/ssl/example_com/example_com.key;
ssl_protocols TLSv1.2 TLSv1.3;
# Add your existing website configuration here.
}| Important
Use |
If you use a Multi-Domain or Wildcard SSL certificate, configure the appropriate server_name values and HTTPS server blocks. The same certificate and private key can be referenced by multiple server blocks when the certificate covers their hostnames.
The Nginx configuration location depends on your operating system and installation. Common locations include:
| Location | Purpose |
|---|---|
/etc/nginx/nginx.conf |
Main Nginx configuration |
/etc/nginx/conf.d/ |
Additional configuration files |
/etc/nginx/sites-available/ |
Virtual host configurations on some distributions |
/etc/nginx/sites-enabled/ |
Enabled virtual host configurations on some distributions |
Nginx supports OCSP Stapling, which lets the server include a recent OCSP response in the TLS handshake. This feature is optional and requires the issuing CA to provide a usable OCSP responder.
To enable it, add these directives inside your HTTPS server block:
ssl_stapling on;
ssl_stapling_verify on;
resolver DNS_RESOLVER_IP;
ssl_trusted_certificate /etc/nginx/ssl/example_com/trusted-ca.pem;Replace DNS_RESOLVER_IP with the IP address of a DNS resolver reachable from your server.
The file configured with ssl_trusted_certificate must contain the appropriate intermediate CA certificate(s) and trusted root certificate required to verify the OCSP response. It is a separate PEM trust file, not necessarily the same as the fullchain file.
| Certificate chain vs. trusted CA file
|
For additional information, see the official Nginx SSL module documentation.
Before reloading Nginx, check the configuration for syntax and configuration errors:
sudo nginx -tIf the test reports that the configuration is successful, continue to the next step. Otherwise, fix the reported errors first.
Apply the updated configuration without unnecessarily terminating active connections:
sudo systemctl reload nginxIf your system does not use systemd, use the appropriate service management command for your operating system.
Open your website using HTTPS and verify that the browser accepts the certificate and the correct hostname is covered.
You can also inspect the certificate chain served by Nginx from the command line:
openssl s_client -connect domainname.com:443 -servername domainname.com -showcertsConfirm that the domain certificate is served first, followed by the correct intermediate certificate(s), and review the reported verification status. Replace domainname.com with your actual hostname.
If your website is hosted on multiple web servers, you normally do not need to purchase a separate SSL certificate for each server. The same certificate and corresponding private key can be installed on multiple servers hosting names covered by that certificate.
Download the certificate from the ClouDNS web panel and obtain the matching Actalis, RapidSSL, or Sectigo certificate chain in Step 1. Securely copy the private key and complete certificate chain to each required server, then configure Nginx using the same instructions.
The private key must match the SSL certificate and should be transferred and stored securely.
For a Wildcard SSL certificate, ensure the wildcard hostname is included in the certificate. For example:
*.domain.com |
Configuration file names and directory structures differ between operating systems and Nginx installations. Refer to your operating system and Nginx documentation to confirm which files should be modified.