Relution Signet Customer Hub

Native installation: Renew certificate

In a native installation on Windows or Linux, nginx serves the SSL certificate. If the new certificate was issued with a new key pair (new CSR), the server.key file is additionally replaced with the new private key. If the same CSR was used, server.key remains unchanged.

The server.pem file contains the server certificate including the intermediate certificates. A purchased certificate is first prepared as described in Renew a purchased certificate →, which also covers the conversion from other formats such as PFX.

Windows

For a Windows installation, the procedure is as follows:

  1. By default, the certificate and the key are located at %ProgramFiles%\nginx\server.pem and %ProgramFiles%\nginx\server.key. If the files are not located there, the nginx.conf file shows where they were placed. This file can usually be found at %ProgramFiles%\nginx\conf\nginx.conf.

  2. Within this file, the paths are listed in the following section. nginx resolves relative paths against the directory of nginx.conf (%ProgramFiles%\nginx\conf).

    nginx.conf
    ssl_certificate      "C:/Program Files/nginx/server.pem";
ssl_certificate_key  "C:/Program Files/nginx/server.key";

  3. The server.pem file is replaced with that of the new certificate, or it is opened in an editor (run as administrator) and its contents are replaced with those of the new certificate. If a new key pair was used, the server.key file whose path is listed under ssl_certificate_key is replaced as well.

  4. The configuration is then checked with nginx.exe -t in a command prompt opened as administrator in the %ProgramFiles%\nginx directory, which also detects a key that does not match the certificate. The nginx service is then restarted with sc stop nginx and sc start nginx or via the Services console (services.msc). If nginx does not start, the %ProgramFiles%\nginx\logs\error.log file provides details.

  5. Whether nginx serves the new certificate is shown by the certificate details in the browser when Relution is opened, for example by the new expiry date.

Linux (Rocky/Alma)

For a native Linux installation, the procedure is as follows:

  1. First, it is checked whether the expired certificate is located at /etc/pki/tls/certs/server.pem. If the file is not located there, the ssl_certificate, ssl_certificate_key and, if applicable, ssl_trusted_certificate entries in /etc/nginx/conf.d/relution-ssl.conf show the actual location.

  2. If so, a copy is made, the file is opened, its contents are removed, and the contents of the new certificate are copied into the server.pem file.

  3. Alternatively, the existing file can be renamed and the new certificate placed at that path under the name server.pem:

    sudo mv /etc/pki/tls/certs/server.pem /etc/pki/tls/certs/server.pem.old
sudo mv server.pem /etc/pki/tls/certs
sudo chown root:root /etc/pki/tls/certs/server.pem
sudo chmod 644 /etc/pki/tls/certs/server.pem
sudo restorecon -v /etc/pki/tls/certs/server.pem

    If SELinux runs in enforcing mode (default), restorecon restores the correct security context. Otherwise, SELinux may deny nginx access to the certificate (see Deprecated: Linux (Alma) →).

    If a new key pair was used, the private key is replaced as well:

    sudo mv server.key /etc/pki/tls/private
sudo chown root:root /etc/pki/tls/private/server.key
sudo chmod 600 /etc/pki/tls/private/server.key
sudo restorecon -v /etc/pki/tls/private/server.key

    If OCSP stapling is used, the certificate chain file (ssl_trusted_certificate) is renewed as well.

  4. The configuration is then checked with sudo nginx -t, which also detects a key that does not match the certificate. The service is then restarted with sudo systemctl restart nginx. If nginx does not start, the /var/log/nginx/error.log file provides details.

  5. Whether nginx serves the new certificate is shown by the certificate details in the browser when Relution is opened, for example by the new expiry date.