32

So I'm setting up an nginx server with SSL enabled with a server definition something like:

server {
    listen :80;
    listen [::]:80;
    server_name example.org;
    root /foo/bar;

    ssl on;
    ssl_certificate /path/to/public/certificate;
    ssl_certificate_key /path/to/private/key;

    ...
}

You get the idea (please forgive any typos).

Anyway, what I'm wondering is; if I renew my certificate(s), is there a way to install them without having to restart nginx?

For example, if I were to use symbolic links from /path/to/public/certificate and /path/to/private/key, pointing to my current certificate(s), would I still need to restart nginx if I were to simply change these to point to new (renewed) certificates? Are there alternatives?

26

Yes, I'm pretty sure you would need to reload Nginx in order for the renewed certificates to display the correct expiration date, but a simple cache-clearing and browse should allow you to view this.

Or if you prefer cli, you could always use the old trusty OpenSSL command:

echo | openssl s_client -connect your.domain.com:443 | openssl x509 -noout -dates

That would give you the current dates on the certificate. In your case the port would be 80 instead of 443.

Many times nginx -s reload does not work as expected. On many systems (Debian, etc.), you would need to use /etc/init.d/nginx reload.

You can always specify the configuration file directly if all else fails, by nginx -c /path/to/nginx.conf.

  • Whoops, those listens should have been for port 443, my bad! Anyway, thanks for the great answer! – Haravikk Dec 5 '15 at 11:22
  • 8
    nginx reload and restarting Nginx are two different things: reload does not restart Nginx but only send it SIGHUP signal. Is SIGHUP signal enough? – porton Aug 16 '16 at 16:25
  • 11
    Yes. Sending a SIGHUP will cause nginx to switch to the updated certificate. – rspeed Sep 22 '16 at 18:09
  • What's the function of echo | in your command? If I leave it out, I don't get a prompt back. I would like to grep the output for notAfter and then compare that to the current date, to spam myself a couple of days before the cert expires. – Amedee Van Gasse Jan 23 '17 at 14:40
  • @AmedeeVanGasse the echo pipe just makes the OpenSSL shell exit cleanly back to Bash and return the output as normal. This is necessary in order for the clean exit for use in scripts and for automation purposes like it sounds like you are planning. I have implemented numerous scripts like the one you are planning using that same basic functionality. – rubynorails Feb 1 '17 at 18:17
21

On receiving SIGHUP nginx will reload updated configuration, verify it while opening log files and reading SSL certificates, then gracefully shut down worker processes relying on previous configuration.

If it happens that nginx can't read some SSL certificates, I'll continue to run using older configuration. Otherwise put, it'll continue to function and process requests no matter what you did to your config files. Even if they're broken, your websites will still open.

So yes, you don't have to restart nginx and risk putting your server offline for more than just some seconds if you want nginx to see updated certs. It should be enough to:

sudo service nginx reload

In most current distributions with systemd used by default you can also reload nginx with the following command:

sudo systemctl reload nginx
  • 3
    On Ubuntu 16, CentOS 7, and other systems supporting systemd you can also execute sudo systemctl reload nginx (which sudo service nginx reload mentioned above is aliased to). – Ville Jan 1 '17 at 19:44
  • @Ville you're right, but that's one more command to remember; and ain't there systemd everywhere – sanmai Jan 2 '17 at 8:45
  • I love to do service nginx restart. I never get tired of seeing how fast it completes. However, if it's in a cron job, and I won't be seeing any of it, I'd rather do some sort of reload to avoid breaking any sort of persistent session or pending operation that might be ongoing. – Rolf Jan 15 '18 at 16:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.