---
title: "How to configure Nginx"
slug: "clm-configure-nginx"
updated: 2026-11-06T17:14:40Z
published: 2026-11-06T17:14:40Z
canonical: "docs.senhasegura.io/clm-configure-nginx"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.senhasegura.io/llms.txt
> Use this file to discover all available pages before exploring further.

# How to configure Nginx

This document provides information on how to configure the Nginx publishing profile to make it possible to install and publish certificates on the server.

## Requirements

- A device registered in the Segura™ Platform with Nginx installed and configured. More information in [How to configure a device](/v4-2/docs/pam-device-configure-device).
- The credential used to connect to the Nginx server must belong to the `sudoers` group on the target server. Publishing a certificate always runs the privileged commands with `sudo`.
Attention

If the credential uses an SSH key instead of a password, the configured user must also have the `NOPASSWD` permission enabled in the server's `sudoers` file. Without it, publishing fails.
- If you are publishing a certificate with a password, you must create a file with the password and declare it in the configuration file through the Nginx `ssl_password_file` parameter. More information in [Module ngx_http_ssl_module](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_password_file).

## Configure Nginx

To configure Nginx, see the following steps:

1. On Segura™ Platform, in the navigation bar, hover over the **Products menu** and select **Certificate Manager**.
2. From the side menu, go to **Publishing** > **Publishing profiles**.
3. Click the **Add** button and select **Nginx**.
4. In the **Settings** tab, complete the following fields:
  1. In the **Profile name *** field, enter the profile's name.
  2. In the **Credential username** field, enter the name of the credential used to access the Nginx server.
  3. Optional: Check the **Use a registered credential to access all devices** option, and in the **Access credential registered in the system** field, select the access credential registered in Segura™ Platform to be used to access the Nginx server.
5. Click **Continue**.
6. In the **Nginx** tab, complete the following fields:
  1. Optional: In the **Site** field, enter the site where the certificate will be published. If the site is unavailable or no value is entered, Nginx publishes the certificate to its default site.
  2. In the **Configuration file path** field, enter the configuration file path in the Nginx server. For example: `/etc/nginx/sites-available/example.conf`.
  3. In the **Port** field, enter the port used in this site. The default port is 443.
  4. In the **Delete password file after publication (if the file exists)** field, select **Yes** to delete the password file after the certificate is published.
7. Click **Continue**.
8. In the **Devices** tab, select the device where Nginx is installed.
  1. The **Network Connector** column shows **Yes** or **No**, depending on whether the device has its own Network Connector agent configured.
9. In the **Review** tab, review all the information entered previously and click **Save**.

After configuring Nginx, the profile appears in the [Publishing profiles](/v4-2/docs/clm-publishing-profiles) report. Now, you can publish certificates in your Nginx server. More information in [How to publish a certificate](/v4-2/docs/certificates-flow-how-to-publish-a-certificate).

## Installation and verification via Network Connector

If the device has a Network Connector configured, Segura® Platform uses that same connector for both the certificate installation and the TLS verification that follows. The execution log shows the route used at each step:

- Installation: `Network Connector: <agent>`.
- Verification: `TLS verification via Network Connector: <agent>`, or `TLS verification: direct connection to <host>:<port>` if the device has no Network Connector.

During the verification, Segura® connects to the server on the port entered in the **Port** field and compares the fingerprint of the certificate the server presents with the fingerprint of the published certificate:

- If the fingerprints match, the execution log records `Fingerprints verified`, and the publication succeeds.
- If the fingerprints differ, the publication fails with the error `Fingerprint comparison failed`.
- If Segura® cannot connect to the server, the publication still ends successfully. The execution log records that Segura® could not communicate with the server on that port.

Attention

Through a Network Connector, the verification connects without SNI. If Nginx serves several SSL server blocks on the same port, the verification can reach a server block other than the one with the new certificate, and the publication fails even though the new certificate is in use.