---
title: 'How to config SSL on Nginx'
url: 'https://www.voidfox.de/ssl_ocsp'
markdown: 'https://www.voidfox.de/ssl_ocsp.md'
date: '2023-05-14'
description: "How to config SSL on Nginx First things first: You can generate your config using Mozilla's Generator And Nginx's config itself is very well documented on their own Website. Getting a B Grade is just not good enough One of first Problems i stumbled over, was only getting a B Grade on Qualy's ssl…"
taxonomy:
  category:
    - blog
  tag:
    - Nginx
    - SSL
    - Config
---

# How to config SSL on Nginx

[ Hole ](https://www.voidfox.de/)      How to config SSL on Nginx    

## [How to config SSL on Nginx](https://www.voidfox.de/ssl_ocsp)

  [Nginx](https://www.voidfox.de/tag:Nginx#body-wrapper) [SSL](https://www.voidfox.de/tag:SSL#body-wrapper) [Config](https://www.voidfox.de/tag:Config#body-wrapper)  

## How to config SSL on Nginx

First things first:
You can generate your config using [Mozilla's Generator](https://ssl-config.mozilla.org)
And Nginx's config itself is very well documented on their own Website.

#### Getting a B Grade is just not good enough 

One of first Problems i stumbled over, was only getting a B Grade on [Qualy's ssllabs](https://www.ssllabs.com).
The Grade is capped there, if you havnt properly set up **SSL OCSP**

The relevant config settings for it to work are the following:

> ssl\_stapling on;
> ssl\_stapling\_verify on;
> ssl\_trusted\_certificate /path/to/your/file;

Using the Nginx Error log you can also keep track what went wrong.

> sudo tail -f /var/log/nginx/error.log

Many Hosters make it easy to get the SSL Certs, but it is also very easy to confuse which is which.
For **SSL OCSP** to work properly we need to provide all Certificates in the **SSL Chain** in a single File.
Doesn't matter if you copy'n'paste them using notepad or pipe them into a new file.

The File should look like this:

> \-----BEGIN CERTIFICATE-----
> xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
> \-----END CERTIFICATE-----
> \-----BEGIN CERTIFICATE-----
> xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
> \-----END CERTIFICATE-----
> \-----BEGIN CERTIFICATE-----
> xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
> \-----END CERTIFICATE-----

![SSL_Chain](https://www.voidfox.de/images/2/f/9/5/e/2f95e7166f3611ffd6eec101e6a61e3120a517d4-figurechain.jpg "SSL_Chain")
Source: [Digicert](https://knowledge.digicert.com/solution/SO16297.html)

With OpenSSL installed you can also make sure it's working as intented:

> echo QUIT | openssl s\_client -connect [www.your-website.com](http://www.your-website.com):443 -status 2> /dev/null | grep -A 17 'OCSP response:' | grep -B 17 'Next Update'

Once you've succeded you will also get a better grade on [Qualy's ssllabs](https://www.ssllabs.com)

 [ Previous Post](https://www.voidfox.de/shell_tools) [Next Post ](https://www.voidfox.de/weechat-cheat-sheet)

#### Related Posts

- 30 

     [Linux Hardening](https://www.voidfox.de/linux-hardening "Linux Hardening")

#### Random Article

 [ I'm Feeling Lucky!](https://www.voidfox.de/random)

#### Popular Tags

  [CheatSheet](https://www.voidfox.de/tag:CheatSheet) [Linux](https://www.voidfox.de/tag:Linux) [ZFS](https://www.voidfox.de/tag:ZFS) [Storage](https://www.voidfox.de/tag:Storage) [Virtualization](https://www.voidfox.de/tag:Virtualization) [Distro](https://www.voidfox.de/tag:Distro) [Weechat](https://www.voidfox.de/tag:Weechat) [Nginx](https://www.voidfox.de/tag:Nginx) [SSL](https://www.voidfox.de/tag:SSL) [Config](https://www.voidfox.de/tag:Config) [Security](https://www.voidfox.de/tag:Security) [SSH](https://www.voidfox.de/tag:SSH) [Tools](https://www.voidfox.de/tag:Tools) [Shell](https://www.voidfox.de/tag:Shell) [Git](https://www.voidfox.de/tag:Git) [Fun](https://www.voidfox.de/tag:Fun)

---

## Navigation

- Parent: [Hole](https://www.voidfox.de/index.md)
- Previous: [Weechat Cheat Sheet](https://www.voidfox.de/weechat-cheat-sheet.md)
- Next: [Linux Shell Tools](https://www.voidfox.de/shell_tools.md)