Setting up SSL on Nginx on AWS Ubuntu instance

Question

I currently have a NodeJS (Koa.js) / Angular4+ application sat on an AWS instance running Linux that I need to configure to use SSL. I have followed a few tutorials online, generated the SSL cert and attempted to get this working and so far I have had no luck.

Let me run you through what I have done so far:

I have generated the SSL certificate and it is in a file called ssl-bundle.crt in the /home/ubuntu directory on the instance. I also have the key sat in the same directory.

I have configured my server block on Nginx for the application as follows (/etc/nginx/sites-available/dashboard.conf):

server {
        listen 80;
        return 301 https://$host$request_uri;
}

server {
        listen 443;

        ssl_certificate /home/ubuntu/ssl-bundle.crt;
        ssl_certificate_key /home/ubuntu/dashboard.d*****d.key;

        ssl on;
        ssl_session_cache  builtin:1000  shared:SSL:10m;
        ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
        ssl_prefer_server_ciphers on;

        access_log            /var/log/nginx/d*****d.access.log;

        location / {
               proxy_set_header Host $host;
               proxy_set_header X-Real-IP $remote_addr;
               proxy_pass http://localhost:4000;
               proxy_set_header        X-Forwarded-Proto $scheme;
        }
}

The Node application is running on port 4000 so I have a proxy_pass to that address when someone access that url. When I don't use SSL the application runs fine when accessing that URL, but when I attempt to use the above server block code trying to access the URL causes a time out. Can anyone help me here or see what is wrong with my configuration?

Thanks

Answer 1

Turns out this wasn't an Nginx issue but an issue with the AWS security group. I hadn't allowed 443 as an incoming port in the settings. Once I did this it worked fine. Hope this helps anyone in future using AWS.

Answer 2

We have used letsencrypt on several of our API servers and I have found it quite an easy setup. Please see this tutorial for a tested step by step .