Week 4, Day 3 — Nginx Virtual Host & SSL/TLS

Lab 4C — Install Nginx, virtual host, SSL certificate, DH parameters, HTTPS server block

Part 1 — Install and verify (5 min)

• sudo apt install nginx. Check status: sudo systemctl status nginx. Test the default page: curl http://localhost. Should return the Nginx welcome HTML. Note the default document root: /var/www/html/.

Part 2 — Create virtual host for yourname.net (20 min)

• Create the document root and an index file:
  sudo mkdir -p /var/www/yourname.net/html
sudo nano /var/www/yourname.net/html/index.html
  Add simple content: <h1>Welcome to yourname.net</h1>
• Create the server block config:
  sudo nano /etc/nginx/sites-available/yourname.net
  Enter:
• server {
listen 80;
listen [::]:80;
root /var/www/yourname.net/html;
index index.html index.htm;
server_name yourname.net www.yourname.net;
access_log /var/log/nginx/yourname.net.access.log;
error_log /var/log/nginx/yourname.net.error.log;
location / {
try_files $uri $uri/ =404;
}
}
• Enable the site by creating a symlink:
  sudo ln -s /etc/nginx/sites-available/yourname.net /etc/nginx/sites-enabled/
• Test and reload:
  sudo nginx -t — must show "syntax is ok" and "test is successful"
  sudo systemctl reload nginx
  Test: curl http://yourname.net (from S1 if DNS resolves to localhost, or specify IP). Browse from Windows host to http://yourname.net.

Part 3 — Generate SSL certificate and DH parameters (15 min)

• Generate a self-signed certificate (fill in FQDN as yourname.net when prompted):
  sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
-keyout /etc/ssl/private/nginx-selfsigned.key \
-out /etc/ssl/certs/nginx-selfsigned.crt
  Key flags: -x509 (self-signed), -nodes (no passphrase), -days 365 (validity), -newkey rsa:2048 (generate new 2048-bit RSA key pair simultaneously).
• Start the DH parameter generation — this runs in the background while you work on snippets:
  sudo openssl dhparam -out /etc/nginx/dhparam.pem 4096 &
  The & sends it to the background. It takes 2–5 minutes. Do not skip this step — without it, the ssl-params.conf snippet will fail to load when referencing dhparam.pem.

Part 4 — Create SSL snippet files (15 min)

• Create the certificate path snippet:
  sudo nano /etc/nginx/snippets/self-signed.conf
ssl_certificate /etc/ssl/certs/nginx-selfsigned.crt;
ssl_certificate_key /etc/ssl/private/nginx-selfsigned.key;
• Create the encryption parameters snippet:
  sudo nano /etc/nginx/snippets/ssl-params.conf
  Enter the TLS 1.3 cipher configuration from the lab sheet. Key directives to understand:
  ssl_protocols TLSv1.3; — only allow TLS 1.3 (disables older, weaker versions)
  ssl_dhparam /etc/nginx/dhparam.pem; — use our DH parameter file
  ssl_stapling on; — OCSP stapling (will warn for self-signed — acceptable in lab)
  add_header X-Frame-Options DENY; — security headers preventing clickjacking

Part 5 — Add HTTPS server block (15 min)

• Verify the DH parameter generation is complete: ls -lh /etc/nginx/dhparam.pem. If the file exists and is non-zero, it's done. If it's still generating, wait.
• Edit /etc/nginx/sites-available/yourname.net. Add a new server block for HTTPS, and modify the existing port 80 block to redirect:
• Existing port 80 block — change to redirect only:
  server {
listen 80;
listen [::]:80;
server_name yourname.net www.yourname.net;
return 301 https://$server_name$request_uri;
}
  New HTTPS block:
  server {
listen 443 ssl;
listen [::]:443 ssl;
include snippets/self-signed.conf;
include snippets/ssl-params.conf;
root /var/www/yourname.net/html;
index index.html index.htm;
server_name yourname.net www.yourname.net;
access_log /var/log/nginx/yourname.net.access.log;
error_log /var/log/nginx/yourname.net.error.log;
location / {
try_files $uri $uri/ =404;
}
}
• Test and restart:
  sudo nginx -t
sudo systemctl restart nginx
  Browse from Windows to https://yourname.net. Accept the self-signed certificate warning. The page should load over HTTPS. Verify the browser padlock shows (with warning) and the URL shows https://.