How do you set up SSL/TLS termination in Nginx?
Learn to configure SSL/TLS termination in Nginx with certificates, secure protocols, and HTTP-to-HTTPS redirects to offload encryption from your backends.
Expected Interview Answer
SSL/TLS termination in Nginx means Nginx accepts encrypted HTTPS connections from clients, decrypts them at the edge, and then forwards plain HTTP (or re-encrypted) traffic to backend servers. You configure it by listening on port 443 with `ssl`, and pointing `ssl_certificate` and `ssl_certificate_key` at your certificate and private key.
A typical setup adds a `server` block listening on `443 ssl` with the certificate chain and key, restricts protocols to modern TLS (1.2/1.3) via `ssl_protocols`, and defines a secure `ssl_ciphers` list. You usually add a second `server` block on port 80 that issues a 301 redirect to HTTPS. Because Nginx handles the CPU-heavy handshake and decryption, backends receive cleartext and stay simpler, and session caching (`ssl_session_cache`) plus OCSP stapling reduce handshake overhead at scale.
- Centralizes certificate management in one place
- Offloads expensive TLS handshakes from application servers
- Enables HTTP/2 and modern cipher suites at the edge
- Simplifies backends since they receive plain HTTP
- Allows enforcing HTTPS redirects and HSTS globally
AI Mentor Explanation
Think of a stadium's main gate where every spectator's sealed ticket envelope is opened and verified before they enter. Fans arrive with locked, tamper-proof envelopes (encrypted requests), the gate staff unseal and check them once, and inside the ground people move freely without re-checking. Nginx is that single gate performing TLS termination — it decrypts and validates at the boundary so the players and stands behind it deal only with already-cleared visitors.
Step-by-Step Explanation
Step 1
Obtain a certificate
Get a certificate and private key from a CA like Let's Encrypt, or generate one for testing.
Step 2
Add an HTTPS server block
Create a `server` block with `listen 443 ssl;` and set `server_name` to your domain.
Step 3
Point to cert and key
Set `ssl_certificate` to the full chain and `ssl_certificate_key` to the private key path.
Step 4
Harden the TLS config
Restrict `ssl_protocols` to TLSv1.2 and TLSv1.3 and define a secure `ssl_ciphers` list.
Step 5
Redirect HTTP to HTTPS
Add a port 80 server block returning a 301 to the https:// URL.
Step 6
Reload and verify
Run `nginx -t` then reload, and confirm the handshake with an SSL checker or `openssl s_client`.
What Interviewer Expects
- Understanding of the difference between termination and passthrough
- Knowing the `ssl_certificate` and `ssl_certificate_key` directives
- Awareness of TLS protocol and cipher hardening
- The HTTP-to-HTTPS redirect pattern
- Familiarity with session caching and OCSP stapling for performance
Common Mistakes
- Providing only the leaf certificate instead of the full chain
- Leaving weak protocols like SSLv3 or TLSv1.0 enabled
- Forgetting to redirect port 80 traffic to HTTPS
- Storing the private key with world-readable permissions
- Confusing SSL termination with end-to-end SSL passthrough
Best Answer (HR Friendly)
“SSL termination is when Nginx acts as the secure front door of a website: it handles the encryption with visitors so the internal servers don't have to. You give Nginx a security certificate and key, tell it to listen for secure HTTPS traffic, and it decrypts everything at the edge before passing simple traffic to the app.”
Code Example
server {
listen 80;
server_name example.com;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl;
http2 on;
server_name example.com;
ssl_certificate /etc/nginx/ssl/fullchain.pem;
ssl_certificate_key /etc/nginx/ssl/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_session_cache shared:SSL:10m;
location / {
proxy_pass http://127.0.0.1:3000;
proxy_set_header Host $host;
}
}Follow-up Questions
- What is the difference between SSL termination and SSL passthrough?
- How does OCSP stapling improve TLS performance?
- How would you automate certificate renewal with Let's Encrypt?
- What is HSTS and how do you enable it in Nginx?
- How do you configure SNI to serve multiple certificates on one IP?
MCQ Practice
1. Which directive specifies the private key file for HTTPS in Nginx?
`ssl_certificate_key` points Nginx to the private key that pairs with the certificate given in `ssl_certificate`.
2. What does SSL/TLS termination at Nginx mean for backend servers?
Nginx decrypts at the edge, so backends receive cleartext HTTP and are freed from TLS work.
3. Which protocols should typically be enabled for a modern secure setup?
Only TLSv1.2 and TLSv1.3 are considered secure; older SSL and TLS versions are deprecated.
Flash Cards
What is SSL/TLS termination? — Nginx decrypts inbound HTTPS at the edge and forwards plain HTTP to backends, centralizing TLS handling.
Two directives required for HTTPS? — `ssl_certificate` (full chain) and `ssl_certificate_key` (private key).
How do you force HTTPS? — Add a port 80 server block that returns a 301 redirect to the https:// URL.
Which TLS protocols are safe today? — TLSv1.2 and TLSv1.3; disable SSLv3, TLSv1.0 and TLSv1.1.