dt.iki.fi

Installing a Commercial SSL Server Certificate (nginx)

Since CACert still isn't "Browser Trusted", and I still don't want to use letsencrypt, I decided to give this a try.

Company-specific (certum.pl) ∆

The company resides inside the European Union and is the cheapest I could find.

This was the process to get the certificate for anyone who's interested:

  1. Buy a certificate (the cheapest, called SSL DV, is enough for my website). Pay first. Get an online account.
  2. Once they see the money they let you procede to the activation process.
  3. On your server, create a certificate signing request thusly:
    openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr
    I left most fields blank, except the 2-letter country code and the "Common Name" which I set to the server FQDN: dt.iki.fi.
  4. Log into my online account on their site and locate the "Activate Certificates" page, click on "Activate", select CSR as delivery method.
  5. Paste the content of server.csr into the CSR window.
  6. Make sure the DNS Domain entry of the certificate points to your website!
  7. Verify - I chose the method "File upload verification".
  8. I received an e-mail with another link. Place a file on your server as instructed, click the link. It should work => green checkmark.
  9. Delete the files/folders used for verification.
  10. Go to "Manage certificates" and locate your now valid certificate. Download the certificate and intermediate certificates all the way down to the root certificate (the one your browser actually "trusts"). As plain text. They will have to get concatenated in the exact order they appear on the website:
    cat actual_certificate.pem domain_validation.pem trusted_network.pem root.pem > cert.chained.pem (*)
  11. Tell nginx to use your server.key (step 3.) and your cert.chained.pem (above), as explained here.
  12. Restart nginx.

Other company ∆

My current VPS provider has a good offer for SSL keys. It's in the EU, but the key provider probably isn't. The online purchase process was very similar. They offered to provide the CSR for me, and the resulting private key. So that's one step less. It's up to you if you want to trust your provider with that.

I got both the certificate and the private key in my customer control panel, but not the chained version - that came as an email attachment straight from the issuer.

Paste the private key into a file, e.g. server.key, and save it to where you want nginx to look for it. Usually under /etc/ssl/private.

You can also click on the green lock for your site in your browser (provided this is not the first time you get SSL) and see all three (why not four as with certum.pl?) keys, and download them one by one, or as a chained file.

After some comparing (these are all plain text files) I see that - after one year - only the first certificate, the one I just bought, has changed and the other 2 are the same. So in case you don't get the readily chained file, some simple copying and pasting will create it.

In any case, nginx will throw an error if they don't fit together.

  1. Tell nginx to use your server.key and your cert.chained.pem, as explained here.
  2. Restart nginx.

Conclusion ∆

I tested the result with this command:
openssl s_client -connect dt.iki.fi:443
But one can see it best in the Browser (click on the green lock).

(*) The certificate chain is explained nicely here.