Automate certificate management for NGINX servers on Linux

Use DigiCert® Trust Lifecycle Manager to automate certificate management for NGINX web servers running on Linux. This guide describes how to set up agent-based automation and manage certificates on your NGINX server.

After you install the DigiCert agent, Trust Lifecycle Manager discovers the NGINX endpoints on the server. Depending on how NGINX is configured, you may need to configure some endpoints manually. You then create a certificate profile for enrollment and configure automation to install a certificate on an unsecured endpoint or replace an existing certificate. From the inventory, you can continue to track and manage these certificates throughout their lifecycle.

Before you begin

DigiCert prerequisites

Make sure Trust Lifecycle Manager can access the certificate authority (CA) that issues your TLS server certificates.
- DigiCert-hosted Private CA is available by default.
- Other CAs require a CA connector.
Ensure that the Linux server meets the system and network requirements for installing and running the DigiCert agent. For more information, see DigiCert agent system requirements.
(Optional) To automate domain control validation (DCV) for certificates issued from CertCentral or Let's Encrypt, configure a DNS integration to use for DNS-based challenges. For more information, see DNS integrations.

NGINX prerequisites

Verify that your NGINX version and operating system are supported. See Supported systems.
Verify that your NGINX configuration meets these requirements:
- The NGINX binary is included in the PATH for the root user.
- NGINX is configured to work with TLS certificates.
- Websites use server blocks. If your NGINX configuration uses nested configuration files, make sure the root configuration file includes the files that contain the server blocks.
  덧붙임. Nested configuration example
  For example, your NGINX configuration can use a root configuration file with nested configuration files:
  config1.conf ├── nested_config_file_1.conf ├── nested_config_file_2.conf └── nested_config_file_n.conf
  A nested configuration file can contain a server block for an endpoint you want to automate. For example:
  server { listen 443 ssl; root /var/www/server-name.example.com; index index.html index.htm index.nginx-debian.html; server_name server-name.example.com; ssl_certificate /path/to/certificate.pem; ssl_certificate_key /path/to/private-key.pem; }

Set up agent-based automation

Install and activate the DigiCert agent, and then create a certificate profile to prepare your NGINX endpoints for certificate automation.

Step 1: Download the agent software

To download the Linux agent software and generate an activation key in Trust Lifecycle Manager:

From the Trust Lifecycle Manager main menu, select Discovery & automation tools > Client tools.
Select Agent - Linux installer.
Use the download button on the right to download the latest version of the DigiCert agent installer for Linux. It should have a name like tlm_agent_N.N.N_linux64.tar.gz, where "N.N.N" is the agent version number.
To get an activation code, select the Generate activation code button under Requirements. In the popup dialog that opens:
1. (Optional) Select a Business unit to assign the agent to. If you make a selection here, only users assigned as administrators for that business unit can manage the agent.
2. (Optional) Under Share the code, select a user to send the activation code to via email. For example, select an admin who will install the agent software.
3. Select the Generate the code button. Copy the code so you can use it to install the agent or provide it to the person who will perform the installation.
참고
The activation code is valid for 30 minutes and is for one-time use only. If it expires, repeat the process to generate a new one.

Step 2: Install and activate the agent

중요

To avoid issues, DigiCert recommends installing the agent software in the /opt directory on Linux. Do not install the agent in the /tmp directory or in a user's home directory.

To install and activate the agent software on a Linux server:

Copy the installer archive you downloaded to the /opt directory or the directory where you want to install the DigiCert agent.
Unpack the installer archive (for example, tar -xzvf <agent-file>.tar.gz). It creates an agent installation directory with a name like tlm_agent_N.N.N_linux64, where "N.N.N" is the agent version number.
Change into the agent installation directory, and run start-tlm-agent.sh as root (for example, sudo ./start-tlm-agent.sh). Follow the prompts to install and activate the agent.
When prompted, enter the Activation code you generated.
When prompted, select how the agent will connect to Trust Lifecycle Manager:
- Direct, no proxy: If the agent will connect directly.
- My own proxy server: If connecting through a third-party proxy server. You are prompted to enter the proxy server details.
- DigiCert sensor as proxy: If using a DigiCert sensor as a proxy server. You are prompted to enter the sensor details.
  참고
  DigiCert sensors include built-in failover support. On the agent, you only need to configure the primary sensor to use as proxy. If your network has multiple DigiCert sensors, the agent will automatically switch to a different sensor if the primary sensor proxy fails.
(Optional) Assign a custom name to the agent to help identify it in Trust Lifecycle Manager.

Step 3: Verify the agent configuration

Verify that the agent is connected to Trust Lifecycle Manager and has correctly identified the NGINX endpoints you want to automate.

From the Trust Lifecycle Manager menu, select Discovery & automation tools > Agents.
Verify that the agent you installed is listed in the table.
Select the agent and verify the following:
- On the General information tab, the NGINX endpoint shows the correct application and application version.
- On the IP/port targets tab, verify that the application and application version for each NGINX port you want to automate is accurate. If the NGINX version is incorrect, edit the agent and select the application and application version for each port.
- The Automation options tab lists additional automation-related settings. If your web server uses Server Name Indication (SNI) to host certificates for different domains on a single IP/port, edit the agent and enable SNI here so the agent can discover and automate the SNI certificates. To learn more, see Server Name Indication.

The agent is now ready to manage certificates on the NGINX endpoints.

Step 4: Create a certificate profile for agent-based enrollment

Create a certificate profile for requesting and managing certificates on NGINX endpoints by using an agent.

From the Trust Lifecycle Manager main menu, go to Policies > Certificate profiles.
Select Create profile from template.

Select a base template that supports managed automation.

To find base templates that support managed automation, look for End-to-end certificate automation in the Use cases column on the Policies > Base templates page. Available templates include those in the following table.

Template name	Trust type	Issuing CA	CA connector
`AWS CA Private Server Certificate`	Private	AWS Private CA	AWS Private CA
`CA Manager Private Server Certificate`	Private	DigiCert® Private CA	N/A
`CertCentral Private Server Certificate`	Private	DigiCert CertCentral®	CertCentral
`CertCentral Public Server Certificate`	Public	DigiCert CertCentral®	CertCentral
`EJBCA Private Server Certificate`	Private	EJBCA	EJBCA
`GlobalSign Public CA Server Certificate`	Public	GlobalSign	GlobalSign
`Let's Encrypt Public Server Certificate`	Public	Let's Encrypt	Let's Encrypt
`Microsoft CA Private Server Certificate`	Private	Microsoft	Microsoft CA
`Sectigo Public CA Server Certificate`	Public	Sectigo	Sectigo
`Step CA Private Server Certificate`	Private	Step CA	Step CA

Configure the following options in the Create certificate profile wizard.
참고
The screens and options available in the wizard depend on the certificate template you started with.
- Enter a name for the profile.
- Select DigiCert agent as the enrollment method for requesting certificates from this profile.
- Configure the following optional settings as needed:
  - Select Auto-renew certificate to automatically renew certificates issued from the profile before they expire.
  - Assign tags and select certificate owners who should receive notifications for all certificates issued from the profile.
For more details on creating a certificate profile, see Use the profile configuration wizard.
Select Next to continue through the wizard, or select Back to return to previous screens and make changes.
Select Create to create the certificate profile.

The certificate profile is now available for certificate automation requests from your NGINX endpoints.

Install a certificate on an unsecured NGINX endpoint

To request and install a certificate on an unsecured NGINX endpoint:

From the Trust Lifecycle Manager main menu, select Discovery & automation tools > Agents.
Select the agent that you installed from the table.
Select Unsecured IP/ports. This opens the Unsecured system view in the inventory, pre-filtered to show endpoints managed by this agent.
Find the endpoint where you want to install the certificate.
In the rightmost column of the table, select the certificate icon (Request certificate).
Complete the Automation request form:
- Choose profile: Select the certificate profile that you created.
- Certificate information: Add the common name, Subject Alternative Name (SAN) attributes, and any additional order options for the certificate.
  중요
  Except for wildcard certificates, the server_name value configured in the NGINX server block must match the certificate common name, a SAN, or both. The common name is also automatically added as a SAN.
- Make any additional selections based on the certificate profile you selected and common name you entered. For example:
  - Specify whether to include both the base domain (example.com) and its www domain (www.example.com) in the certificate.
  - For wildcard certificates, specify whether to install the certificate on virtual hosts that match the base domain or only hosts that exactly match the wildcard pattern.
- Configure scheduling, auto-renewal, agent scripts, certificate owners, and tags as needed.
- Select the checkbox at the end of the form to acknowledge acceptance of the Certificate Services Agreement.
Select Submit.

The certificate is issued and installed on the NGINX endpoint.

Replace the existing certificate on an NGINX endpoint

To replace an existing certificate on an NGINX endpoint:

From the Trust Lifecycle Manager main menu, select Discovery & automation tools > Agents.
Select the agent that you installed from the table.
Select Managed certificates. This opens the Automated system view in the inventory, pre-filtered to show endpoints managed by this agent.
Find the endpoint where you want to replace the existing certificate.
In the rightmost column of the table, select the certificate icon (Request certificate).
Complete the Automation request form:
- Choose profile: Select the certificate profile that you created.
- Certificate information: Add the common name, Subject Alternative Name (SAN) attributes, and any additional order options for the certificate.
  중요
  Except for wildcard certificates, the server_name value configured in the NGINX server block must match the certificate common name, a SAN, or both. The common name is also automatically added as a SAN.
- Make any additional selections based on the certificate profile you selected and common name you entered. For example:
  - Specify whether to include both the base domain (example.com) and its www domain (www.example.com) in the certificate.
  - For wildcard certificates, specify whether to install the certificate on virtual hosts that match the base domain or only hosts that exactly match the wildcard pattern.
- Configure scheduling, auto-renewal, agent scripts, certificate owners, and tags as needed.
- Select the checkbox at the end of the form to acknowledge acceptance of the Certificate Services Agreement.
Select Submit.

The new certificate is issued and installed on the NGINX endpoint, replacing the existing certificate.

참고

You can follow the same workflow to perform other certificate management actions, such as renewing or reissuing a certificate. For details, see Manage endpoints.

View and manage automated certificates

After completing the automation, you can:

View and manage certificates: Go to the Inventory > Endpoints page to view and manage your automated certificates.
Track certificates: In the Automated system view, track active certificates by the endpoint locations where they’re installed.
Auto-renew certificates: If auto-renewal is enabled for the certificate profile, Trust Lifecycle Manager automatically requests and installs a new certificate when the current certificate reaches its configured renewal window.

이 섹션의 내용: