How to configure Nginx

This document provides information on how to configure the Nginx publishing profile to make it possible to install and publish certificates on the server.

Requirements

• A device registered in the Segura™ Platform with Nginx installed and configured. More information in How to configure a device.
• The credential used to connect to the Nginx server must belong to the sudoers group on the target server. Publishing a certificate always runs the privileged commands with sudo.
  Attention

  If the credential uses an SSH key instead of a password, the configured user must also have the NOPASSWD permission enabled in the server's sudoers file. Without it, publishing fails.

• If you are publishing a certificate with a password, you must create a file with the password and declare it in the configuration file through the Nginx ssl_password_file parameter. More information in Module ngx_http_ssl_module.

Configure Nginx

To configure Nginx, see the following steps:

1. On Segura™ Platform, in the navigation bar, hover over the Products menu and select Certificate Manager.
2. From the side menu, go to Publishing > Publishing profiles.
3. Click the Add button and select Nginx.
4. In the Settings tab, complete the following fields:
   1. In the Profile name * field, enter the profile's name.
   2. In the Credential username field, enter the name of the credential used to access the Nginx server.
   3. Optional: Check the Use a registered credential to access all devices option, and in the Access credential registered in the system field, select the access credential registered in Segura™ Platform to be used to access the Nginx server.
5. Click Continue.
6. In the Nginx tab, complete the following fields:
   1. Optional: In the Site field, enter the site where the certificate will be published. If the site is unavailable or no value is entered, Nginx publishes the certificate to its default site.
   2. In the Configuration file path field, enter the configuration file path in the Nginx server. For example: /etc/nginx/sites-available/example.conf.
   3. In the Port field, enter the port used in this site. The default port is 443.
   4. In the Delete password file after publication (if the file exists) field, select Yes to delete the password file after the certificate is published.
7. Click Continue.
8. In the Devices tab, select the device where Nginx is installed.
   1. The Network Connector column shows Yes or No, depending on whether the device has its own Network Connector agent configured.
9. In the Review tab, review all the information entered previously and click Save.

After configuring Nginx, the profile appears in the Publishing profiles report. Now, you can publish certificates in your Nginx server. More information in How to publish a certificate.

Installation and verification via Network Connector

If the device has a Network Connector configured, Segura® Platform uses that same connector for both the certificate installation and the TLS verification that follows. The execution log shows the route used at each step:

• Installation: Network Connector: <agent>.
• Verification: TLS verification via Network Connector: <agent>, or TLS verification: direct connection to <host>:<port> if the device has no Network Connector.

During the verification, Segura® connects to the server on the port entered in the Port field and compares the fingerprint of the certificate the server presents with the fingerprint of the published certificate:

• If the fingerprints match, the execution log records Fingerprints verified, and the publication succeeds.
• If the fingerprints differ, the publication fails with the error Fingerprint comparison failed.
• If Segura® cannot connect to the server, the publication still ends successfully. The execution log records that Segura® could not communicate with the server on that port.