How to install a free SSL certificate on nginx

What you’ll do: get a free 90-day certificate (no account needed), turn it into the two files nginx wants, point nginx at them, and reload. About five minutes.

Before you start:

• A domain you control (say, example.com).
• nginx running on your server.
• Access to your DNS provider to add two short records.

If you don’t have a certificate yet, get one first — it’s free and there’s no signup:

Get your free certificate →

Step 1 — Get your certificate from Beacon

1. Enter your domain and email on the Beacon home page.
2. Add the two DNS records Beacon gives you (they prove you own the domain).
3. Click validate, choose a password, and download your bundle. You’ll get a single file, bundle.p12, protected by that password.

The .p12 file holds three things in one: your certificate, the chain that vouches for it, and your private key.

Step 2 — Turn the .p12 into two PEM files

nginx doesn’t read .p12 files. It wants two plain-text PEM files: the certificate chain and the private key. One tool you already have — openssl — splits them out.

Run these where you saved bundle.p12. Each command asks for the password you chose:

# 1) The certificate chain (your cert + the intermediate), what nginx serves to visitors
openssl pkcs12 -in bundle.p12 -nokeys -out fullchain.pem

# 2) Your private key, unencrypted so nginx can read it at startup
#    OpenSSL 3.x: use -noenc instead of -nodes
openssl pkcs12 -in bundle.p12 -nocerts -nodes -out privkey.pem

You now have fullchain.pem and privkey.pem.

Step 3 — Put the files somewhere safe

sudo mkdir -p /etc/ssl/beacon
sudo mv fullchain.pem privkey.pem /etc/ssl/beacon/
sudo chmod 600 /etc/ssl/beacon/privkey.pem   # only root should read the key

Your private key is sensitive — keep it readable only by root, as above.

Step 4 — Point nginx at the certificate

Open your site’s server block (often in /etc/nginx/sites-available/ or /etc/nginx/conf.d/) and add an HTTPS listener:

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name example.com www.example.com;

    ssl_certificate     /etc/ssl/beacon/fullchain.pem;
    ssl_certificate_key /etc/ssl/beacon/privkey.pem;

    # your site config...
}

# Send plain HTTP to HTTPS
server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

Replace example.com with your domain. Beacon covers your domain and its www. version, so both are listed above.

Step 5 — Test and reload

sudo nginx -t          # checks your config for mistakes
sudo systemctl reload nginx

Visit https://example.com. You should see the padlock, with no warning.

You’re done — now don’t get caught by the expiry

Your certificate is valid for 90 days. nginx won’t renew it for you, and Beacon doesn’t auto-renew — when the time comes, run the flow again and repeat these steps.

The simple way to never miss the date is TLS Radar (free to start): it watches every certificate you own, checks your setup for problems, and emails you well before anything expires — so https:// never turns into a warning page by surprise.

Explore TLS Radar →

Troubleshooting

• nginx -t says the key doesn’t match the certificate — you likely swapped the two files. fullchain.pem goes in ssl_certificate, privkey.pem in ssl_certificate_key.
• Browser warns about an incomplete chain — make sure you used fullchain.pem (which includes the intermediate), not just your leaf certificate.
• openssl asks for a password and rejects it — it wants the password you chose in Beacon when you downloaded the bundle, not your server login.

FAQ

Is the certificate free? Yes. Beacon issues free 90-day certificates from Let’s Encrypt, with no account and no credit card.

Why doesn’t nginx just take the .p12 file? nginx reads PEM files, not PKCS#12. That’s why Step 2 splits the .p12 into fullchain.pem and privkey.pem.

Do I have to do this every 90 days? Yes — the certificate lasts 90 days. Set up TLS Radar (free) and it’ll remind you in plenty of time so you’re never caught out.

Get your free certificate — no signup →