Let us take a closer look at the certificate transparency Nginx and the various configurations associated with it to set it up and manage it. At Bobcares our Server Management support services will give you a detailed overview and note of the entire process.

Nginx Certificate Transparency module

This module adds TLS-signed certificate timestamp functionality to Nginx. This is one of the technologies that Google’s Certificate Transparency projects for delivering Signed Certificate Timestamps to TLS clients. The nginx-ct supports serving SCTs as part of the TLS handshake during HTTPS connections.

nginx Certificate Transparency, Configuration

Let us perform the configurations for certificate transparency nginx. For this, Add –add-module=/path/to/nginx-ct to the nginx ./configure invocation.

If we are running nginx 1.9.11 or higher, we can construct as a dynamic module using —add-dynamic-module=/path/to/nginx-ct.

Given that we constructed it as a dynamic module, add the following directives to the configuration file’s top level:

load_module modules/ngx_ssl_ct_module.so;
load_module modules/ngx_http_ssl_ct_module.so;

We can also load ngx mail SSL ct module, as well as ngx stream SSL ct module. As a result, whether we require mail or stream support.

Add the following directives to the configuration file, which are valid in HTTP, mail, stream, and server blocks for certificate transparency Nginx management:

ssl_ct on;
ssl_ct_static_scts /path/to/sct/dir;

The module will read all *.sct files in the specified directory that are anticipated to be binary encoded. This is the same format as the mod ssl ct module in Apache.

If we use nginx 1.11.0 or higher and do not use BoringSSL, the module is compatible with nginx’s multiple certificate support. For each ssl certificate directive, exactly one ssl ct static scts directive must be specified:

ssl_ct on;
ssl_certificate /path/to/rsa.pem;
ssl_certificate_key /path/to/rsa.key;
ssl_ct_static_scts /path/to/rsa/scts;
ssl_certificate /path/to/ecdsa.pem;
ssl_certificate_key /path/to/ecdsa.key;
ssl_ct_static_scts /path/to/ecdsa/scts;

ct-submit can send certificates to log servers and encode the SignedCertificateTimestamp struct for usage with this module.

[Need assistance with similar queries? We are here to help.]

Conclusion

To conclude we have learned about the certificate transparency Nginx and the configurations to set it up with the assistance of our Server management support services.