Moving https website from server A (CentOS 7) to server B (CentOS 8) - what do I need to do regarding certificates?

Question

I've copied all of the referenced files in my nginx configuration over:

• /etc/nginx/ssl/STAR_example_com/ssl-bundle.crt
• /etc/nginx/ssl/STAR_example_com/STAR_example.key
• /etc/ssl/certs/dhparam.pem

I was optimistic that might be all I'd need to do, but didn't believe it would be...

When I browse to https://new.example.com it just spins, and eventually times out.

I have configured my DNS correctly, I believe. dig seems to confirm this. I have configured my firewall correctly, I believe. firewall-cmd --list-all shows services: cockpit dhcpv6-client http https ssh.

The site was working on http://<ipaddress>/. For the domain I have no option but to use https rather than http (as one might, for testing etc) as it's preloaded HSTS.

What am I missing? I'm completely clueless when it comes to certs. Is it the STAR_example.key file - should that be a private key relating to the machine it's on? If so how do I generate a new one?

The fact that it's timing out rather than coming back with an error of some sort has me stumped...

Thank you!

Answer 1

It sounds to me very much like you have not enabled and configured NGINX to listen on port 443 (and I'm guessing you have not told it where to find the certs either).

https://nginx.org/en/docs/http/configuring_https_servers.html tells you how to configure https - to summarise - typically add something like the following to your NGINX config file -

  server {
      listen              443 ssl;
      server_name         www.example.com;
      ssl_certificate     www.example.com.crt;
      ssl_certificate_key www.example.com.key;
      ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
      ssl_ciphers         HIGH:!aNULL:!MD5;
  }

Your NGINX config files can be found at /etc/nginx - I expect you can add it to /etc/nginx/nginx.conf but there is likely to be a directory structure with subdirectories which include files which could be more elegant.

Once you have made the changes you will want to reload the config -

   sudo systemctl reload nginx