SSL certificate monitoring in Nginx reverse proxy

Nginx is a high-performance web server and reverse proxy server. It is widely used in many large websites and applications because it is stable and reliable. The SSL (Secure Sockets Layer) certificate is a digital certificate used to securely transfer data between the client and the server. In Nginx, the use of SSL certificates is closely related to reverse proxy. This article will explore the use of SSL certificates in Nginx reverse proxy and its monitoring.

SSL Certificate Usage in Nginx Reverse Proxy

In Nginx, the reverse proxy server acts as a front-end server, receiving requests from clients and forwarding them to the back-end server. When Nginx acts as a reverse proxy server, it can also be used to encrypt and decrypt SSL connections, which requires the use of an SSL certificate.

In order to configure the SSL certificate in Nginx, we need to generate the SSL certificate first. Certificates can be generated using many different tools, including OpenSSL, ACME Client, and Certbot. Here we take using OpenSSL to generate a certificate as an example.

Use OpenSSL to generate an SSL certificate

Before using OpenSSL to generate an SSL certificate, we need to install OpenSSL on the server. We can use the following command to verify whether OpenSSL has been installed:

openssl version

If the version information of OpenSSL is returned, it means it has been installed. If it is not installed, you can install it through the following command:

sudo apt-get update
sudo apt-get install openssl

After the installation is completed, we can use the following command to generate the certificate:

sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/nginx/ssl/nginx.key -out /etc/nginx/ssl/nginx.crt

This command will generate a self-certificate valid for 365 days. Sign the SSL certificate and store it in the /etc/nginx/ssl directory. Among them, nginx.key is the private key file and nginx.crt is the certificate file.

Configuring SSL certificates in Nginx

Once the certificates are generated, they can be configured into Nginx. The following configuration can be added to the Nginx configuration file:

server {
  listen 443 ssl;
  server_name example.com;

  ssl_certificate /etc/nginx/ssl/nginx.crt;
  ssl_certificate_key /etc/nginx/ssl/nginx.key;

  location / {
    proxy_pass http://localhost:8000;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    # This line enables HTTPS for the proxy
    proxy_ssl_verify                  on;
    proxy_ssl_certificate            /etc/nginx/ssl/nginx.crt;
    proxy_ssl_certificate_key        /etc/nginx/ssl/nginx.key;
    proxy_ssl_session_reuse          on;
  }
}

This configuration indicates that Nginx will listen for HTTPS connections on port 443 and use the generated SSL certificate to encrypt the connection. It also sets up a reverse proxy that forwards client requests to http://localhost:8000.

SSL Certificate Monitoring

The SSL certificate is valid for a limited time. Once a certificate expires, it is no longer valid, causing the website to become unsafe. Therefore, the SSL certificate used in the Nginx reverse proxy needs to be monitored to ensure the validity period of the certificate.

The following are some common methods of SSL certificate monitoring:

1. View the certificate expiration time

You can use the following command to view the expiration time of the SSL certificate:

echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null | openssl x509 -noout -dates

Where example.com is the domain name of your website. This command will output the start date and expiration date of the certificate.

2. Nagios Monitoring

Nagios is a comprehensive monitoring solution that helps you monitor servers, applications, and network services. It can also monitor the expiration time of SSL certificates. To use Nagios to monitor SSL certificates, you need to install Nagios and the SSL Certificate Monitoring plugin for Nagios.

3. Let's Encrypt

Let's Encrypt is a free SSL certificate authority that helps you easily configure SSL certificates for Nginx reverse proxy. Additionally, Let's Encrypt certificates are valid for 90 days, so you need to renew your certificate regularly.

In order to use Let's Encrypt to obtain an SSL certificate, you need to install Certbot. After installing Certbot, you can run the following command to obtain the certificate:

sudo certbot certonly --webroot -w /var/www/example.com -d example.com

Where, /var/www/example.com is the root directory of your website, and example.com is the domain name of your website. Certbot will automatically verify it on your server and issue you a certificate.

Conclusion

This article introduces the use and monitoring method of SSL certificate in Nginx reverse proxy. When using an SSL certificate, you must regularly check the certificate's expiration time. By automatically renewing certificates using Nagios monitoring or Let's Encrypt, you can ensure that your certificate is always valid. Monitoring SSL certificates is a key step in protecting your website and customer data.

The above is the detailed content of SSL certificate monitoring in Nginx reverse proxy. For more information, please follow other related articles on the PHP Chinese website!