Secure Your ServerPilot Apps: A Quick Guide to SSL Installation

Updated: 10 Jan, 2025 • 0 • min read

Table of Contents

Want to lock down your ServerPilot apps with SSL and ditch that scary “Not Secure” warning? This guide walks you through installing a Comodo Positive SSL certificate, perfect for WordPress sites hosted on ServerPilot. No more shared SSL shenanigans!

SSL Installation
image just illustration

Prepping for SSL Success¶

Before diving in, gather your tools:

Cyberduck: For easy file transfers.
Putty: Your command-line gateway to the server.
SSL Certificate: Snag a Comodo Positive SSL from a reputable vendor.
CSR (Certificate Signing Request): We’ll generate this later.
Private Key: Keep this secret, safe, and sound.
Server IP Address: Know where you’re going.
Root Password: Ultimate server access.

Getting Your SSL Certificate¶

First, purchase your Positive SSL certificate. During the purchase process, you’ll need to generate a CSR. Use a CSR generator tool online. Important: Use www.your-domain.com if that’s your site URL, or YOUR-DOMAIN.COM if you skip the “www.” The SSL certificate applies to only one version.

You’ll receive two crucial files: the CSR and your Private Key. Keep backups! The CSR will have tags like this:

-----BEGIN CERTIFICATE REQUEST-----
Some random unique characters
-----END CERTIFICATE REQUEST-----

And the Private Key will look like this:

-----BEGIN PRIVATE KEY-----
Some random unique characters
-----END PRIVATE KEY-----

Save the CSR with a .csr extension and the Private Key with a .key extension.

After domain verification, the certificate issuer will send you a zip file with the certificate files. You’ll typically see files like these:

www_domain-name_com.crt
COMODORSADomainValidationSecureServerCA.crt
COMODORSAAddTrustCA.crt
AddTrustExternalCARoot.crt

Sometimes, you’ll get just two files:

www_domain-name_com.ca-bundle
www.domain-name_com.crt

The .ca-bundle file combines the other three certificate files.

Server-Side Setup with Putty¶

Fire up Putty and log into your server using your IP address, port 22, “root” as the username, and your root password. Then, run these commands:

cd /etc/nginx-sp
mkdir certs
cd certs
mkdir your-domain.com
cd your-domain.com

Now, use Cyberduck (or your preferred file transfer method) to upload all your certificate files (CSR, Private Key, and the .crt files) into this newly created your-domain.com directory.

If you received four certificate files, run this command in Putty:

cat www_domain-name_com.crt COMODORSADomainValidationSecureServerCA.crt COMODORSAAddTrustCA.crt AddTrustExternalCARoot.crt >> chain.crt

If you received the .ca-bundle file, use this command instead:

cat www.domain-name_com.crt www_domain-name_com.ca-bundle >> chain.crt

Configuring Nginx¶

Navigate to your app’s Nginx configuration directory:

cd /etc/nginx-sp/vhosts.d/app-name.d

(Replace app-name.d with your app’s actual directory name).

Create a file named ssl.conf and paste this code into it:

listen 443 ssl;
listen [::]:443 ssl;
ssl_certificate /etc/nginx-sp/certs/your-domain.com/chain.crt;
ssl_certificate_key /etc/nginx-sp/certs/your-domain.com/private.key;
ssl_session_cache shared:SSL:20m;
ssl_session_timeout 10m;
ssl_prefer_server_ciphers on;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH!aNULL:!MD5:!DSS;
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/nginx-sp/certs/your-domain.com/www_domain-name_com.crt;
set $ssl_status off;
if ($scheme = "https") {
  set $ssl_status on;
}
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Ssl $ssl_status;

Remember to replace the file names with your actual file names!

Next, create another file named off.nossl_conf in the same directory and add this code:

if ($scheme != "https") {
  return 301 https://$server_name$request_uri;
}

Testing and Restarting¶

Test your Nginx configuration:

nginx-sp -t

You should see a success message. If so, restart Nginx:

service nginx-sp restart

Redirects and Verification¶

Use an online SSL Checker to confirm your SSL installation. You’ll also need to set up redirects from HTTP to HTTPS. If your site is already listed in Google Search Console or Bing Webmaster Tools, re-verify it with the HTTPS version. Update your links on social media too.

HTTPS with WWW:¶

Add this to your .htaccess file:

RewriteEngine on
RewriteCond %{HTTP_HOST} ^your-domain.com [NC]
RewriteRule ^(.*)$ http://www.your-domain.com/$1 [L,R=301,NC]
RewriteEngine On
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://www.your-domain.com/$1 [R,L]

HTTPS without WWW:¶