# Nginx and godaddy ssl cert. How to?

**URL:** <https://www.ruby-forum.com/t/nginx-and-godaddy-ssl-cert-how-to/191665>\
**Category:** NGINX\
**Created:** [July 15, 2010, 11:17pm UTC](https://www.ruby-forum.com/t/nginx-and-godaddy-ssl-cert-how-to/191665 "2010-07-15T23:17:22Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![audreylee88](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/ecae2f/32.png) [@audreylee88](https://www.ruby-forum.com/u/audreylee88)\
**Post date:** [July 15, 2010, 11:17pm UTC](https://www.ruby-forum.com/t/nginx-and-godaddy-ssl-cert-how-to/191665/1 "2010-07-15T23:17:22Z")

</div>

Hello nginx people.

I want to use nginx to serve https for my site.

I followed directions given by godaddy to generate a csr file.

I gave $25 and the csr file to godaddy.

They gave me 2 files:

gd\_bundle.crt  
toadfrog.com.crt

I am curious about what to do with these files.

How do I declare that I want my /etc/nginx/nginx.conf file to use  
these 2 crt files?

Also I used a file to help create the csr file which I sent to godaddy.

It call it: toadfrog.key

I used toadfrog.key to create the csr, where do I put toadfrog.key now?

Here is a screendump of me creating the csr with toadfrog.key:

deploy@domU-12-31-38-00-95-21 ~ $  
deploy@domU-12-31-38-00-95-21 ~ $ openssl genrsa -des3 -out toadfrog.key  
2048  
Generating RSA private key, 2048 bit long modulus  
…+++  
…+++  
e is 65537 (0x10001)

Enter pass phrase for toadfrog.key:  
Verifying - Enter pass phrase for toadfrog.key:

Then to create the csr:

## deploy@domU-12-31-38-00-95-21 ~ $ deploy@domU-12-31-38-00-95-21 ~ $ openssl req -new -key toadfrog.key -out toadfrog.csr Enter pass phrase for toadfrog.key: You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter ‘.’, the field will be left blank.

Country Name (2 letter code) [AU]:US  
State or Province Name (full name) [Some-State]:NV  
Locality Name (eg, city) []:Reno  
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Toadfrog,  
Inc.  
Organizational Unit Name (eg, section) []:IT

Common Name (eg, YOUR name) []:Audrey L.  
Email Address []:removed\_email\_address@domain.invalid

Please enter the following ‘extra’ attributes  
to be sent with your certificate request  
A challenge password []:  
An optional company name []:  
deploy@domU-12-31-38-00-95-21 ~ $  
deploy@domU-12-31-38-00-95-21 ~ $

If you have a 2 or 3 minutes, feel free to post some tips or comments.

Thanks

---

<div class="post-metadata">

**Author:** ![audreylee88](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/ecae2f/32.png) [@audreylee88](https://www.ruby-forum.com/u/audreylee88)\
**Post date:** [July 15, 2010, 11:23pm UTC](https://www.ruby-forum.com/t/nginx-and-godaddy-ssl-cert-how-to/191665/2 "2010-07-15T23:23:49Z")

</div>

On Thu, Jul 15, 2010 at 2:16 PM, Audrey L. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
wrote:

> Hello nginx people.
> 
> I want to use nginx to serve https for my site.

1. Generate the CSR:  
openssl genrsa 2048 \> yourhost.com.key  
openssl req -new -key yourhost.com.key \> yourhost.com.csr

2. Enter in only a couple pieces of information:

Country Name (2 letter code) [AU]:US  
State or Province Name (full name) [Some-State]:.  
Locality Name (eg, city) :.  
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Something  
Here  
Organizational Unit Name (eg, section) :.  
Common Name (eg, YOUR name) :yourhost.com  
Email Address :.

Please enter the following ‘extra’ attributes  
to be sent with your certificate request  
A challenge password :  
An optional company name :

1. Paste the CSR into Godaddy, get back the .crt file

2. Combine the cert + godaddy chain  
cat yourhost.com.crt gd\_bundle.crt \> yourhost.com.pem

Then in nginx:

ssl\_certificate /etc/nginx/certs/yourhost.com.pem;  
ssl\_certificate\_key /etc/nginx/certs/yourhost.com.key;

Additionally I have these:

ssl on;  
ssl\_protocols SSLv3 TLSv1;  
ssl\_ciphers ALL:-ADH:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP;  
ssl\_session\_cache shared:SSL:10m;

Helps maintain a better SSL experience, passes McAfee Secure’s SSL  
checks, etc.

---

<div class="post-metadata">

**Author:** ![audreylee88](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/ecae2f/32.png) [@audreylee88](https://www.ruby-forum.com/u/audreylee88)\
**Post date:** [July 16, 2010, 12:46am UTC](https://www.ruby-forum.com/t/nginx-and-godaddy-ssl-cert-how-to/191665/3 "2010-07-16T00:46:21Z")

</div>

Michael,

Thanks for the writeup.  
It is very easy to follow; bravo!

It appears that nginx does not like my key.

I created it using instructions from godaddy:

deploy@domU-12-31-38-00-95-21 ~ $ openssl genrsa -des3 -out toadfrog.key  
2048  
Generating RSA private key, 2048 bit long modulus  
…+++  
…+++  
e is 65537 (0x10001)  
Enter pass phrase for toadfrog.key:  
Verifying - Enter pass phrase for toadfrog.key:

Anyway, here is what nginx is now telling me:

domU-12-31-39-0B-15-75 ~ # /etc/init.d/nginx restart

- Checking nginx’ configuration …

2010/07/15 15:32:05 [emerg] 24186#0:  
SSL\_CTX\_use\_PrivateKey\_file("/etc/nginx/ssl/toadfrog.key")

failed (SSL: error:0D07207B:asn1 encoding  
routines:ASN1\_get\_object:header too long

error:0D068066:asn1 encoding routines:ASN1\_CHECK\_TLEN:bad object  
header error:0D07803A:asn1 encoding routine:: dοTlhο4?dο)?

2010/07/15 15:32:05 [emerg] 24186#0: the configuration file  
/etc/nginx/nginx.conf test failed

Would you agree that godaddy gave me the wrong shell command to create  
toadfrog.key ?

---

<div class="post-metadata">

**Author:** ![audreylee88](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/ecae2f/32.png) [@audreylee88](https://www.ruby-forum.com/u/audreylee88)\
**Post date:** [July 16, 2010, 2:26am UTC](https://www.ruby-forum.com/t/nginx-and-godaddy-ssl-cert-how-to/191665/4 "2010-07-16T02:26:28Z")

</div>

I have no clue. All I know is mine has worked a lot 🙂

---

<div class="post-metadata">

**Author:** ![audreylee88](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/ecae2f/32.png) [@audreylee88](https://www.ruby-forum.com/u/audreylee88)\
**Post date:** [July 16, 2010, 4:29am UTC](https://www.ruby-forum.com/t/nginx-and-godaddy-ssl-cert-how-to/191665/5 "2010-07-16T04:29:58Z")

</div>

I have sites that get crawled and analyzed by mcafee secure. They  
consider the site to be out of compliance without it.

---

<div class="post-metadata">

**Author:** ![audreylee88](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/ecae2f/32.png) [@audreylee88](https://www.ruby-forum.com/u/audreylee88)\
**Post date:** [July 16, 2010, 3:05am UTC](https://www.ruby-forum.com/t/nginx-and-godaddy-ssl-cert-how-to/191665/6 "2010-07-16T03:05:06Z")

</div>

> It is very easy to follow; bravo!  
> It appears that nginx does not like my key.

Try to use only crt file for ssl\_certificate directive. You may append  
godaddy’s CA later.

(to read fields of the certificates you may use something like “openssl  
x509 -text \< yourfile.crt | less”)

If nginx (openssl technically) would reject your key, ask godaddy to  
reissue cert (not sure if they would charge you a fee).

If you’ll do that - generate new CSR again (do not agree to use old one)  
and make sure you saved right key.

BTW, Michael, Unless you’re using banking site or something that  
requires 256 bit security I’d not bother to crank ciphers to ALL. Choose  
carefully… (Google uses RC4-SHA1 everywhere and it’s fastest 128bit  
one at the moment)

Alex.

---

<div class="post-metadata">

**Author:** ![audreylee88](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/ecae2f/32.png) [@audreylee88](https://www.ruby-forum.com/u/audreylee88)\
**Post date:** [July 16, 2010, 4:57am UTC](https://www.ruby-forum.com/t/nginx-and-godaddy-ssl-cert-how-to/191665/7 "2010-07-16T04:57:29Z")

</div>

Hi Folks,

Should each proxy\_cache\_path “keys\_zone” have a separate path?

For instance, should we have?

proxy\_cache\_path /home/nginx/run/proxy\_cache levels=1:2 inactive=1d  
max\_size=1m keys\_zone=Zone1:10m;  
proxy\_cache\_path /home/nginx/run/proxy\_cache levels=1:2 inactive=1d  
max\_size=5m keys\_zone=Zone2:100m;

Or:

proxy\_cache\_path /home/nginx/run/proxy\_cache/zone1 levels=1:2  
inactive=1d  
max\_size=1m keys\_zone=Zone1:10m;  
proxy\_cache\_path /home/nginx/run/proxy\_cache/zone2 levels=1:2  
inactive=1d  
max\_size=5m keys\_zone=Zone2:100m;

Thanks,

-peter

---

<div class="post-metadata">

**Author:** ![audreylee88](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/ecae2f/32.png) [@audreylee88](https://www.ruby-forum.com/u/audreylee88)\
**Post date:** [July 16, 2010, 11:30am UTC](https://www.ruby-forum.com/t/nginx-and-godaddy-ssl-cert-how-to/191665/8 "2010-07-16T11:30:52Z")

</div>

On Thu, Jul 15, 2010 at 10:56:31PM -0400, Peter Portante wrote:

> Or:
> 
> proxy\_cache\_path /home/nginx/run/proxy\_cache/zone1 levels=1:2 inactive=1d  
> max\_size=1m keys\_zone=Zone1:10m;  
> proxy\_cache\_path /home/nginx/run/proxy\_cache/zone2 levels=1:2 inactive=1d  
> max\_size=5m keys\_zone=Zone2:100m;

Yes, they must have a separate path.

–  
Igor S.

> **[Igor Sysoev](http://sysoev.ru/en/)**