2.3. Adding TLS encryption to an NGINX web server

Procedure

1. Edit the /etc/nginx/nginx.conf file, and add the following server block to the http block in the configuration:

   server {
       listen              443 ssl;
       server_name         example.com;
       root                /usr/share/nginx/html;
       ssl_certificate     /etc/pki/tls/certs/example.com.crt;
       ssl_certificate_key /etc/pki/tls/private/example.com.key;
   }

2. Optional: Starting with RHEL 9.3, you can use the ssl_pass_phrase_dialog directive to configure an external program that is called at nginx start for each encrypted private key. Add one of the following lines to the /etc/nginx/nginx.conf file:

   • To call an external program for each encrypted private key file, enter:

     ssl_pass_phrase_dialog exec:<path_to_program>;

     NGINX calls this program with the following two arguments:

     • The server name specified in the server_name setting.
     • One of the following algorithms: RSA, DSA, EC, DH, or UNK if a cryptographic algorithm cannot be recognized.

   • If you want to manually enter a passphrase for each encrypted private key file, enter:

     ssl_pass_phrase_dialog builtin;

     This is the default behavior if ssl_pass_phrase_dialog is not configured.

     注意

     The nginx service fails to start if you use this method but have at least one private key protected by a passphrase. In this case, use one of the other methods.

   • If you want systemd to prompt for the passphrase for each encrypted private key when you start the nginx service by using the systemctl utility, enter:

     ssl_pass_phrase_dialog exec:/usr/libexec/nginx-ssl-pass-dialog;

3. For security reasons, configure that only the root user can access the private key file:

   # chown root:root /etc/pki/tls/private/example.com.key
   # chmod 600 /etc/pki/tls/private/example.com.key

   警告

   If the private key was accessed by unauthorized users, revoke the certificate, create a new private key, and request a new certificate. Otherwise, the TLS connection is no longer secure.

4. Restart the nginx service:

   # systemctl restart nginx