UPDATE: It’s about time to update this article or write a new one with the fact that there is letsencrypt now & that the SPDY protocol has been deprecated in favor of http 2.0.

Also see https://certbot.eff.org/ if you haven’t already.

Recently, I spent sometime setting up the Transport Layer Security (SSL) for the sites https://bubbl.in and https://marvindanig.com each. It was simple to do and went pretty much smoothly except for a few warts here and there that I found SSL industry is generally plagued with. But more on that later.

Starting today, both Bubblin and Marvindanig sites are going to be served only on secured http a.k.a https. For the record all our traffic is now forced over TLS, and we have ensured forward secrecy as well.

Marvindanig::Application.configure do

config.force_ssl = true

I sourced our SSL certificate for $9 via NameCheap (a referral URL) but you can buy it from anywhere you like. Remember to use a working email address of the domain name you wish to buy the certificate for. Your SSL provider will validate you with the domain name of the email address you provide.

Setting up SSL certificate is easy but it does take some time. It took about 45 minutes for me to get it up and running so that will give you some idea about what follows below.

Here are the steps, if you’re on a Ubuntu/Linux distro with Nginx/Unicorn to serve your app:

SSH/login to your server

1. Install OpenSSL

$ apt-get update

$ apt-get upgrade

$ apt-get install openssl

$ mkdir /etc/ssl/certs #if this directory doesn’t exist already.

2. Issue a Certificate Signing Request (CSR)

Go into the certs directory

$ cd /etc/ssl/certs

$ openssl req -new -newkey rsa:2048 -nodes -days 365 -keyout http://www.mydomain.com.key -out http://www.mydomain.com.csr

This is what you’ll see next:

Generating a 2048 bit RSA private key
......................................................++++++
....++++++
writing new private key to 'www.mydomain.com.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:US
State or Province Name (full name) [Some-State]: California
Locality Name (eg, city) []: MountainView
Organization Name (eg, company) [YourCompanyName]
Organizational Unit Name (eg, section) []: Web Product
Common Name (eg, YOUR name) []:www.yourdomain.com
Email Address []:admin@yourdomain.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

Ignore the extra attributes if you want. Now you’ll have a .key and a .csr file generated inside your certs directory.

Secure the generated key with the following command:

$ chmod 400 /etc/ssl/certs/www.mydomain.com.key

You can also move the .key file into private (etc/ssl/private) directory of your server (where you’ll also find another file with an interesting name: ssl-cert-snakeoil.key.) and secure it there.

3. Buy a Commericial SSL

Now use the .csr file created above to obtain a signed certificate from NameCheap or another provider. Once you’ve completed purchasing SSL, upon validation of email you’ll receive a zipped package containing all your certs – a signed domain_name cert and root and intermediary certificates.

1. Download the zipped folder and unpack its contents. You’ll see a couple of cert files that look something like this:

www_bubbl_in.crt (www_yourdomain_com.crt)

COMODORSADomainValidationSecureServerCA.crt

COMODORSAAddTrustCA.crt

AddTrustExternalCARoot.crt

2. Login into your server and copy all the certs into /etc/ssl/certs directory.

You can also use the latest version 3+ Capistrano-Unicorn-Nginx recipe to handle all things SSL from the comfort of your computer, but I recommend doing it step-by-step manually.

Now chain up all the certificates provided up there into one file with cat command like shown below. I fail to understand why this complication of chaining SSL certificates into one file has been left to customers at all, but:

$ cat www_yourdomain_com.crt COMODORSADomainValidationSecureServerCA.crt COMODORSAAddTrustCA.crt AddTrustExternalCARoot.crt > http://www.yourdomain.chained.crt

Order of appearance of filenames as shown above is important. We’re all set.

4. Configure Nginx and Restart

The server block on your nginx configuration (inside /etc/nginx/sites-enabled folder) will look something like this:

server {

listen 443 ssl spdy;

ssl_certificate /etc/ssl/certs/www.yourdomain.com.chained.crt; ssl_certificate_key /etc/ssl/private/www.yourdomain.com.key;

…

}

Note we’ve also enabled SPDY alongside SSL in there. ☺ .

Simply restart Nginx and voila!, your site is SSL-ready!

While you’re at it, you might want to patch up the heartbleed and other known SSL/TLS related vulnerabilities. Ask your hosting provider for more details.

To verify if everything is set up correctly use the Qualys SSL Analyzer online.

We scored an A+ score there.