Need to set up multiple SSL certificates on one IP with Nginx?

This guide will help you.

Secure Socket Layer (SSL) certificates allow two-way encrypted communication between a client and a server. 

Here at Ibmi Media, as part of our Server Management Services, we regularly help our Customers to perform Nginx related queries.

In this context, we shall look into the steps to set up multiple SSL certificates on one IP with Nginx.

How to host multiple SSL certificates on one IP with Nginx ?

SNI ( Server Name Identification) allows hosting multiple SSL certificates on a single IP address.

Traditionally, separate SSL certificates for each site required separate IP addresses. However, this process is now simplified through the use of Server Name Indication (SNI).

Requirements to host multiple SSL certificates on one IP with Nginx:

i. Registered domain names so that it can serve the certificates by SNI.

ii. Nginx must already be installed and running on the VPS.

iii. However, here is the command to install Nginx:

# sudo apt-get install nginx

iv. SNI must be enabled on the server. Here is the command that displays the version and status.

# nginx -V

How to set up multiple SSL certificates on one IP with Nginx ?

To configure multiple SSL certificates, follow the steps below:

1. First, we create an SSL certificate Directory.

Here, we are considering two domains example.com and example.org.

The SSL certificate has 2 main parts that is the certificate and the public key. We should create a directory for each virtual hosts SSL certificate.

# mkdir -p /etc/nginx/ssl/example.com
# mkdir -p /etc/nginx/ssl/example.org

2. Next, we create the Server Key and Certificate Signing Request

i. First, we create an SSL certificate for example.com.

# cd /etc/nginx/ssl/example.com

ii. Then, we create a private server key. While creating, we need to enter a pass-phrase, which is needed later to access the certificate.

# sudo openssl genrsa -des3 -out server.key 1024

iii. Now, we create a certificate signing request by running the below command.

# sudo openssl req -new -key server.key -out server.csr

iv. This will prompt a terminal to display a list of fields that need to be filled in.

3. Remove the Passphrase

We need to remove the passphrase. Even though having the passphrase in place provides better security, the issue appears when one tries to reload the Nginx.

In the event that Nginx crashes or needs to reboot, we will always have to re-enter the passphrase to get the entire web server back online.

# sudo cp server.key server.key.org
# sudo openssl rsa -in server.key.org -out server.key

4. Sign the SSL Certificate

i. To sign an SSL Certificate, execute:

# sudo openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

This certificate will expire after one year.

We have done with the certificate in the first host.

ii. In order to create the certificate in the first host, we switch the directory

# cd /etc/nginx/ssl/example.org

iii. Then we repeat the previous three steps for the second certificate as well. After that, we start adding the certificates to the virtual hosts.

5. Create the Virtual Hosts

After having the certificates saved, we add our information to the virtual host file:

server {
listen 443;
server_name example.com;
root /usr/share/nginx/www;
index index.html index.htm;
ssl on;
ssl_certificate /etc/nginx/ssl/example.com/server.crt;
ssl_certificate_key /etc/nginx/ssl/example.com/server.key;
}

Each file will then contain the virtual host configuration as follows:

server {
listen 443;
server_name example.com;
root /usr/share/nginx/www;
index index.html index.htm;
ssl on;
ssl_certificate /etc/nginx/ssl/example.com/server.crt;
ssl_certificate_key /etc/nginx/ssl/example.com/server.key;
}

Also, we ensure that we have updated server_name, ssl_certificate, and ssl_certificate_key lines to match our details.

Then, we do the same for the second account :

# sudo nano /etc/nginx/sites-available/example.org
server {
listen 443;
server_name example.org;
root {Specify the document root for example.org};
index index.html index.htm;
ssl on;
ssl_certificate /etc/nginx/ssl/example.org/server.crt;
ssl_certificate_key /etc/nginx/ssl/example.org/server.key;
}

6. Activate the Virtual Hosts

Now, we activate the hosts by creating a symbolic link between the sites-available directory and the sites-enabled directory. For that, we run the below commands:

# sudo ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/example.com
# sudo ln -s /etc/nginx/sites-available/example.org /etc/nginx/sites-enabled/example.org

7. Restart Nginx

Finally, we restart Nginx by running the below command.

# sudo service nginx restart

[Need urgent assistance with Nginx related configurations? – We're available 24*7. ]