Skip to content

Instantly share code, notes, and snippets.

@clemlatz

clemlatz/self-signed-ssl-certificate.md

Last active January 3, 2025 23:24
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save clemlatz/579b547cc04f205b929d32e4f243d4f9 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save clemlatz/579b547cc04f205b929d32e4f243d4f9 to your computer and use it in GitHub Desktop.
Download ZIP
Setup a self-signed SSL certificate with Nginx (server and browser)
Raw
self-signed-ssl-certificate.md

1. Configure server: Nginx

  1. Create the certificate:

    $ sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/nginx-selfsigned.key -out /etc/ssl/certs/nginx-selfsigned.crt

  2. Create a strong Diffie-Hellman group:

    $ sudo openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048

  3. Create a new configuration snippet file for Nginx:

    $ sudo nano /etc/nginx/snippets/self-signed.conf

  4. Add:

    ssl_certificate /etc/ssl/certs/nginx-selfsigned.crt; ssl_certificate_key /etc/ssl/private/nginx-selfsigned.key;

  5. Create a configuration snippet with strong encryption settings:

    $ sudo vim /etc/nginx/snippets/ssl-params.conf

  6. Add:

    from https://cipherli.st/

    and https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_prefer_server_ciphers on; ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH"; ssl_ecdh_curve secp384r1; ssl_session_cache shared:SSL:10m; ssl_session_tickets off; #ssl_stapling on; #ssl_stapling_verify on; resolver 8.8.8.8 8.8.4.4 valid=300s; resolver_timeout 5s;

    Disable preloading HSTS for now. You can use the commented out header line that includes

    the "preload" directive if you understand the implications.

    #add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"; #add_header Strict-Transport-Security "max-age=63072000; includeSubdomains"; add_header X-Frame-Options DENY; add_header X-Content-Type-Options nosniff;

    ssl_dhparam /etc/ssl/certs/dhparam.pem;

2. Configure computer: macOS

  1. From local computer, download certificate:

    $ scp user@host:/etc/ssl/certs/nginx-selfsigned.crt ~/cert.crt

@uniruddh
Copy link

uniruddh commented Dec 20, 2017

Nice consolidated details.

@codecakes
Copy link

codecakes commented Dec 23, 2017

Need something that works for mobile browsing too

@nicolasembleton
Copy link

nicolasembleton commented Mar 7, 2018

@codecakes Adding trusted certificate on mobile will fix it. But I'd personally recommend avoiding this and using letsencrypt with dev-only domain name.

@IAlwaysBeCoding
Copy link

IAlwaysBeCoding commented May 23, 2018

Why use nano and vim and not just use one?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment