0

I've installed nginx on AWS using this configure script

--prefix=/usr/local/nginx-1.16.1 --with-http_ssl_module --with-openssl=~/Downloads/openssl-1.1.1i --without-http_rewrite_module

and I've issued a Certificate for my URL (let it be mydom.com) using the AWS Certificate Manager (ACM) and its status is displayed as Issued Then I've edited the relevant section in the nginx.conf

server {
listen 443 ssl;
server_name localhost mydom.com;
ssl_certificate  /etc/ssl/certs/ca-bundle.crt;
ssl_certificate_key  /etc/trusted-key.key;
<truncated>
}

I've selected the files: /etc/ssl/certs/ca-bundle.crt and /etc/trusted-key.key only because they were there on the Linux File System and just for the sake of trying to see if nginx would run with them but it didn't run. It gave:

[emerg] cannot load certificate key "/etc/trusted-key.key": PEM_read_bio_PrivateKey() failes (SSL: error:0909006C:PEM routines:get_name: no start line:Expecting: ANY PRIVATE KEY)

Of course that was just a try. Otherwise I think I should probably use the .crt file issued by the ACM (if there are any) and then I should somehow create a .key file and put them somewhere in the Linux File System, like under the /etc/nginx/ssl? I'm not sure. How should I proceed?

Note: I have some experience running web applications on my own web server but using only the http I haven't much experience with https

Terry
  • 123
  • 1
  • 7

1 Answers1

1

ACM certificates can only be used by AWS managed services, primarily load balancers. You can't access the private key so you can't present an ACM cert using Nginx installed on your EC2 instance.

Your best options are:

  • Terminate https at an ALB, forward traffic over http to the web server
  • Use a Let's Encrypt certificate. There's a wide range of software to choose from that helps automate this.
Tim
  • 31,888
  • 7
  • 52
  • 78
  • Thank you for the answer. Actually I've tried first using the **http** I've set at the DNS, the **A** type of record to the IP which is written as `Public IPs: 100.26.187.63 Private IPs: 172.31.92.210` under the AWS Instance screen, hoping that (after starting nginx with https section commented out) I'd open a browser and enter *http://mydom.com* and the nginx to serve the sample html page but no it doesn't. I wonder what's missing. – Terry Jan 08 '21 at 11:27
  • Probably best ask another question with more detail about your general Nginx setup. – Tim Jan 08 '21 at 19:51