0

I got a RaspberryPi on which I want to host Owncloud. So I followed this tutorial and it works well except the SSL part. I don't want to use self signed.
I set my own subdomain and it works without ssl, also outside my home network. I didn't try the self signed certificate.

The command which I used created the certificates (found in this tutorial):

sudo openssl req -new -newkey rsa:4096 -nodes -out /etc/nginx/cert/my_example_com.csr -keyout /etc/nginx/cert/my_example_com.key -subj "/C=NL/ST=none/L=none/O=none/OU=none/CN=my.example.com"

files

  • /etc/nginx/cert/my_example_com.csr
  • /etc/nginx/cert/my_example_com.key

In the nginx: /etc/nginx/sites-available/default

## other stuff from tut
server {
    listen 80;
    server_name my.example.com;
    return 301 https://$server_name$request_uri; # enforce http
}

server {
    listen 443 ssl;
    server_name my.example.com;

    ssl_certificate /etc/nginx/cert/my_example_com.csr;
    ssl_certificate_key /etc/nginx/cert/my_example_com.key;
## other stuff from tut

After I submitted the .csr content I to my webhoster I recieved a zip with 3 files:

  • my_example_com.cert
  • CA_Root.cert
  • CA_Intermediate.cert

I tried all 3 files for the ssl_certificate value they don't work.
So I googled and found multiple sources saying the I needed the merge those files in some order. (source, source, source)

But the file names in my situation are all a bit different and it's just confusing.
Some sources talk about .crt files some about .pem but I got .cert. Does the file extension even matter?

Does anybody know how I should set(/merge?) these files to make my site work on ssl?
note: This is the first time I work with nginx or ssl-certificates

2 Answers 2

1

Try this: Configuring HTTPS servers - SSL certificate chains

    $ cat www.example.com.crt bundle.crt > www.example.com.chained.crt

The resulting file should be used in the ssl_certificate directive:

    server {
        listen              443 ssl;
        server_name         www.example.com;
        ssl_certificate     www.example.com.chained.crt;
        ssl_certificate_key www.example.com.key;
        ...
    }
2
  • Typo in the chaining: bundle.crt should read CA_Intermediate.crt
    – Tricky
    Dec 6, 2014 at 0:43
  • I get the impression you didn't read my entire question. I don't have a bundle.crt file.
    – janw
    Dec 6, 2014 at 9:43
0

The main fault was the modem from the ISP. After that I figured out it was:

sudo cat my_example_com.cert CA_Intermediate.cert CA_Root.cert >> bundle.cert

Mainly suggested here

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .