Securing Your AWS EC2 Nginx Server: A Step-by-Step SSL Installation Guide

Introduction

SSL (Secure Sockets Layer) is a security protocol that establishes a secure and encrypted connection between a web server and a browser. It is used to secure data transmission over the internet, ensuring that sensitive information remains private and protected from potential hackers.

Prerequisites

To install Certbot and Nginx on an AWS instance, follow these steps:

• Connect to your AWS instance using SSH

• Update the package list by running the command: sudo apt update

• Install Nginx by running the command: sudo apt install nginx

• Once Nginx is installed, start the server by running the command: sudo systemctl start nginx

• Check the status of Nginx by running the command: sudo systemctl status nginx — the “active (running)” status indicates that Nginx is running.

• Next, install Certbot by running the following commands:

• sudo apt install software-properties-common

• sudo add-apt-repository universe

• sudo add-apt-repository ppa:certbot/certbot

• sudo apt update

• sudo apt install certbot python-certbot-nginx

7. Once Certbot is installed, you can now generate and install a free SSL certificate for your domain. Run the command: sudo certbot — nginx -d domain.com -d www.domain.com

8. Certbot will prompt for some information and ask you to agree to the terms of service. After agreeing, Certbot will generate and install the SSL certificate for your domain.

9. To configure Nginx to use the SSL certificate, open the Nginx configuration file for your domain by running the command: sudo nano /etc/nginx/sites-available/domain.com

10. Look for the “server_name” directive and add your domain name to it (e.g. server_name domain.com www.domain.com;)

11. Look for the “listen 80” directive and add “listen 443 ssl;” below it.

12. Add the following lines to enable SSL and specify the locations of the SSL certificate and private key:

• ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;

• ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

13. Save and close the file.

14. Test the Nginx configuration by running the command: sudo nginx -t

15. If there are no errors, reload Nginx by running the command: sudo systemctl reload nginx

Obtaining an SSL Certificate with Certbot

To obtain an SSL certificate for a domain on AWS, you will need to follow these steps:

• Log into your AWS EC2 instance and access the terminal. You can do this through the AWS console or by connecting via SSH.

• Stop the Nginx web server running on your instance. This is necessary because the certificate validation process requires port 80 to be free. You can stop Nginx by running the following command:

```
sudo systemctl stop nginx
```

3. Install Certbot, a free and open-source tool for obtaining and renewing SSL certificates. Depending on the Linux distribution running on your instance, there may be different commands to install Certbot. For example, for Ubuntu, you can run the following commands:

```
sudo add-apt-repository ppa:certbot/certbot
sudo apt-get update
sudo apt-get install certbot
```

4. Once Certbot is installed, you can run it to obtain your SSL certificate. The command you will need to run depends on the type of web server and the distribution you are using. You can find more information about this in the Certbot documentation.

5. Generally, the command will look something like this:

```
sudo certbot --nginx -d example.com -d www.example.com
```

This will run Certbot and obtain an SSL certificate for your domain. If successful, you will be prompted to provide an email address and agree to the terms of service.

6. Certbot will then automatically configure your web server to use the newly obtained SSL certificate.

7. Once the certificate is obtained and configured, you can restart Nginx by running the following command:

```
sudo systemctl start nginx
```

Your website should now be using an SSL certificate, and you can access it using HTTPS.

Configuring Nginx with SSL

Using an SSL certificate on Nginx is a relatively straightforward process that involves obtaining the certificate, configuring Nginx to use it, and restarting Nginx to apply the changes. Below are the steps you can follow to set up Nginx to use your SSL certificate on AWS:

• Obtain an SSL certificate: The first step is to obtain a certificate from a trusted Certificate Authority (CA) such as Let’s Encrypt or AWS Certificate Manager. You can follow the instructions provided by your CA to obtain the certificate.

• Copy the certificate files: Once you have obtained the certificate, copy the certificate files to your AWS server. The files typically include the certificate itself, the private key, and any intermediate certificates.

• Create a Nginx configuration file: Next, you will need to create a Nginx configuration file for your website. This file will contain the necessary directives to enable SSL and point to the certificate and key files you copied in the previous step.

• Configure Nginx to use the certificate: Open your Nginx configuration file and add the following directives to enable SSL and point to the certificate and key files:

```
# Enable SSL
listen 443 ssl;

# Specify the certificate and key files
ssl_certificate /path/to/certificate.crt;
ssl_certificate_key /path/to/privatekey.key;
```

5. Configure Nginx to use secure protocols and ciphers: For added security, you can also specify the protocols and ciphers that Nginx will use. This can be done by adding the following directives to your Nginx configuration file:

```
# Specify the protocols to be used
ssl_protocols TLSv1.2 TLSv1.3;

# Specify the ciphers to be used
ssl_ciphers HIGH:!aNULL:!MD5;
```

6. Test the configuration: After making the necessary changes, you can test the Nginx configuration to ensure everything is working as expected. You can use the following command to test your configuration:

```
nginx -t
```

If there are no errors, you can proceed to the next step.

7. Restart Nginx: Finally, you will need to restart Nginx to apply the new configuration. You can use the following command to restart Nginx:

```
sudo systemctl restart nginx
```

Your Nginx server should now be configured to use your SSL certificate. You can test it by accessing your website using the HTTPS protocol. If your website loads without any warnings or errors, the SSL certificate has been successfully set up on Nginx.