Create a Self-Signed SSL Certificate for Local Development With Nginx
Apr 29, 2022
We'll create a self-signed SSL certificate on a Linux machine which we can use for local development with Nginx.
Note: This is only for local development, do not use a self-signed SSL certificate on any publicly accessible website.
Create a self-signed SSL certificate
First, we'll create a new directory where will be stored all the required files for this certificate.
sudo mkdir /etc/ssl/self-signed-cert
We'll create an SSL key encrypted with 2048 bits.
sudo openssl genrsa -out "/etc/ssl/self-signed-cert/self-signed-cert.key" 2048
Next, create a certificate sign request with the key we just created.
sudo openssl req -new -key "/etc/ssl/self-signed-cert/self-signed-cert.key" -out "/etc/ssl/self-signed-cert/self-signed-cert.csr"
After this, you will be prompted to enter some information like country name, state or province name, locality name, etc.
You can enter your information here, for example:
Country Name: SR
State or Province name: Serbia
Locality Name: Belgrade
Organization Name: Self Signed SSL Certificate
Organizationl Unit Name:
Common Name:
Email Address:
A challendge password:
An optional company name:
The last step is to create a certificate itself with the request and key we just created.
sudo openssl x509 -req -days 365 -in "/etc/ssl/self-signed-cert/self-signed-cert.csr" -signkey "/etc/ssl/self-signed-cert/self-signed-cert.key" -out "/etc/ssl/self-signed-cert/self-signed-cert.crt"
In this example, the certificate we created will be valid for 1 year (365 days), if you want you can change this per your need.
That's it. Our self-signed SSL certificate is created.
Configure Nginx to use this certificate
To configure an HTTPS server, the SSL parameter must be enabled on listening sockets in the server block, and the locations of the server certificate and private key files should be specified.
Open the Nginx configuration file for a project where you want to use this certificate.
sudo vim /etc/nginx/sites-available/my-app.test
Enable SSL on the listening socket and specified the location of the certificate and private key files.
server {
listen
443 ssl;
ssl_certificate
/etc/ssl/self-signed-cert/self-signed-cert.crt
ssl_certificate_key
/etc/ssl/self-signed-cert/self-signed-cert.key
}
For example, the Nginx config file will look like this after you added those lines:
server {
listen 80;
listen [::]:80;
listen 443 ssl;
// new line
server_name my-app.test www.my-app.test;
root /home/vojislav/code/my-app.test/public;
add_header X-Frame-Options "SAMEORIGIN";
add_header X-Content-Type-Options "nosniff";
ssl_certificate /etc/ssl/self-signed-cert/self-signed-cert.crt;
// new line
ssl_certificate_key /etc/ssl/self-signed-cert/self-signed-cert.key;
// new line
index index.php;
charset utf-8;
location / {
try_files $uri $uri/ /index.php?$query_string;
}
location = /favicon.ico { access_log off; log_not_found off; }
location = /robots.txt { access_log off; log_not_found off; }
error_page 404 /index.php;
location ~ \.php$ {
fastcgi_pass unix:/var/run/php/php8.1-fpm.sock;
fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
include fastcgi_params;
}
location ~ /\.(?!well-known).* {
deny all;
}
}
Next, check if the Nginx configuration is correct.
sudo nginx -t
Output:
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
If everything is ok, restart the Nginx service.
sudo systemctl restart nginx
Now, if you visit your project address it should work with a secure transfer protocol (HTTPS)
That's it, now you can work on your project locally with the HTTPS protocol.