SSL/TLS Certificate Setup
SSL/TLS certificate enables HTTPS: encrypts traffic between browser and server. Without it, browsers show "Insecure connection" warning, Google lowers rankings, modern APIs (PWA, Web Push, Geolocation) become unavailable.
Certificate Types
| Type | Verification | When to Use |
|---|---|---|
| DV (Domain Validation) | Domain only | Most websites |
| OV (Organization Validation) | Domain + organization | Corporate websites |
| EV (Extended Validation) | Extended verification | Banks, payment systems |
Wildcard *.example.ru |
All subdomains | Multi-subdomain architecture |
| Multi-domain (SAN) | Multiple domains | Multiple websites |
For most websites: Let's Encrypt DV (free) or paid DV from Comodo/Sectigo.
Nginx Setup
server {
listen 443 ssl http2;
server_name example.ru www.example.ru;
ssl_certificate /etc/letsencrypt/live/example.ru/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.ru/privkey.pem;
# Recommended TLS settings
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers off;
# HSTS — tell browser to use only HTTPS
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
# OCSP Stapling — speed up certificate verification
ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.8.8 1.1.1.1 valid=300s;
ssl_trusted_certificate /etc/letsencrypt/live/example.ru/chain.pem;
# Session cache for faster handshake
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 1d;
ssl_session_tickets off;
}
# HTTP → HTTPS redirect
server {
listen 80;
server_name example.ru www.example.ru;
return 301 https://example.ru$request_uri;
}
Paid Certificate Installation
# 1. Generate CSR (Certificate Signing Request)
openssl req -new -newkey rsa:2048 -nodes \
-keyout example.ru.key \
-out example.ru.csr \
-subj "/C=RU/ST=Moscow/L=Moscow/O=Company Ltd/CN=example.ru"
# 2. Upload CSR to CA panel
# 3. Complete verification (DNS record or file)
# 4. Get certificate (fullchain.crt) and install
# Nginx: path to certificate
ssl_certificate /etc/ssl/example.ru/fullchain.crt;
ssl_certificate_key /etc/ssl/example.ru/example.ru.key;
Verification
- SSL Labs — full TLS configuration analysis, target: A+ rating
-
openssl s_client -connect example.ru:443— check in terminal -
curl -vI https://example.ru— check headers and TLS
Timeline: few hours for Let's Encrypt; 1–3 days for paid OV/EV with verification.