I use Namecheap.com as a registrar, and they resale SSL Certs from a number of other companies, including Comodo.
These are the steps I went through to set up an SSL cert.
Prior to purchasing a cert, you need to generate a private key, and a CSR file (Certificate Signing Request). You'll be asked for the content of the CSR file when ordering the certificate.
openssl req -new -newkey rsa:2048 -nodes -keyout example_com.key -out example_com.csr
This gives you two files:
example_com.key-- your Private key. You'll need this later to configure ngxinx.example_com.csr-- Your CSR file.
Now, purchase the certificate [1], follow the steps on their site, and you should soon get an email with your PositiveSSL Certificate. It contains a zip file with the following:
- Root CA Certificate - AddTrustExternalCARoot.crt
- Intermediate CA Certificate - COMODORSAAddTrustCA.crt
- Intermediate CA Certificate - COMODORSADomainValidationSecureServerCA.crt
- Your PositiveSSL Certificate - www_example_com.crt (or the subdomain you gave them)
Combine everything for nginx [2]:
Combine the above crt files into a bundle (the order matters, here):
cat www_example_com.crt COMODORSADomainValidationSecureServerCA.crt COMODORSAAddTrustCA.crt > ssl-bundle.crt
Store the bundle wherever nginx expects to find it:
mkdir -p /etc/nginx/ssl/example_com/ mv ssl-bundle.crt /etc/nginx/ssl/example_com/
Ensure your private key is somewhere nginx can read it, as well.:
mv example_com.key /etc/nginx/ssl/example_com/
If you ommit COMODORSAAddTrustCA.crt from the bundle you'll get rid of anchor error, but will get "extra download" warning.
If you want(and you do!) to get OCSP stapling enabled on your server, then you'd need full certificates chain to be available to the server. To work around the problem described above, nginx has another directive that makes certificate known to the server, but not sent to the client - ssl_trusted_certificate.
cat AddTrustExternalCARoot.crt > trusted.crt
And final config should contain those lines:
ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA; ssl_prefer_server_ciphers on; ssl_stapling on; ssl_stapling_verify on; ssl_dhparam "/etc/nginx/certs/dhparam.pem"; ssl_certificate "/etc/nginx/certs/ssl-bundle.crt"; ssl_trusted_certificate "/etc/nginx/certs/trusted.crt"; ssl_certificate_key "/etc/ssl/private/example.com.key"; ssl_session_cache shared:SSL:10m; ssl_session_timeout 10m;
- Reload nginx.
| [1] | I purchased mine through Namecheap.com. |
| [2] | Based on these instructions: http://goo.gl/4zJc8 |