Nginx
Deploys certificates to Nginx servers via SSH, using a CLM agent as an intermediary.
Prerequisites
- Linux CLM agent installed and online with SSH access to the target server
- SSH user with write permission on the target file paths
- Nginx installed and configured with SSL/TLS support
- Certificate destination directory created on the server (e.g.
/etc/nginx/ssl/)
Prepare the server
Create the certificate directory
If the directory doesn't exist yet, create it before configuring the store:
mkdir -p /etc/nginx/ssl
chmod 755 /etc/nginx/ssl
Identify the certificate paths
To find out where Nginx is reading the certificates from, run on the server:
grep -r "ssl_certificate" /etc/nginx/
The result shows the paths configured in the virtual host, for example:
/etc/nginx/sites-available/my-site: ssl_certificate /etc/nginx/ssl/my-site.crt;
/etc/nginx/sites-available/my-site: ssl_certificate_key /etc/nginx/ssl/my-site.key;
Use exactly these paths when configuring the store.
SSH user permissions
The SSH user configured on the store needs write permission on the certificate directory. If you're using a non-root user:
# Grant permission on the directory to the user
chown root:<user> /etc/nginx/ssl/
chmod 770 /etc/nginx/ssl/
# Allow passwordless Nginx reload via sudo
echo "<user> ALL=(ALL) NOPASSWD: /bin/systemctl reload nginx" >> /etc/sudoers
Create via the Stores screen
Step 1 — Provider
Select Unix Provider.
Step 2 — Agent
Select the Linux agent that will establish the SSH connection to the target server.
Step 3 — Configuration
SSH Connection:
| Field | Description |
|---|---|
| Host / IP | Address of the Nginx server |
| SSH Port | SSH port (default: 22) |
| SSH User | User with write permission on the configured paths |
| SSH Password | User's password (optional if using an SSH key) |
Certificate file paths:
| Field | Example | Description |
|---|---|---|
| Certificate file path | /etc/nginx/ssl/my-site.crt | Full path to the leaf certificate |
| Private key file path | /etc/nginx/ssl/my-site.key | Full path to the private key |
| CA Chain file path | /etc/nginx/ssl/my-site-chain.crt | Intermediate chain (optional) |
The correct paths are the ones defined in the `ssl_certificate` and `ssl_certificate_key` directives of your Nginx virtual host. Use `grep -r "ssl_certificate" /etc/nginx/` to locate them.
Service configuration:
| Field | Value | Description |
|---|---|---|
| Reload command | systemctl reload nginx | Reloads Nginx after the deploy. Use sudo systemctl reload nginx if the SSH user isn't root. |
Step 4 — Review
Set the Repository Name, confirm the settings, and click Create Repository.
How the deploy works
When a certificate is installed or renewed, the CLM:
- Connects to the server via SSH using the configured agent
- Writes the files to the configured paths (certificate, key, chain)
- Runs the Reload command to apply the new certificate to Nginx without interrupting the service
The `systemctl reload nginx` command reloads the configuration and certificates without dropping active connections. Use `systemctl restart nginx` only if reload isn't enough to apply the change.
Install a certificate
On the Store details screen, click Install Certificate, select the certificate from the inventory, and confirm.
Troubleshooting
Deploy fails at step 1
The agent couldn't write the file to the destination. Check:
# Confirm the directory exists
ls -la /etc/nginx/ssl/
# Test write access with the configured SSH user
su - <user> -c "touch /etc/nginx/ssl/test && echo OK && rm /etc/nginx/ssl/test"
If it returns Permission denied, adjust the permissions as described in SSH user permissions.
Reload command fails
Check whether the SSH user has permission to run the reload:
# Test the reload with the SSH user
su - <user> -c "sudo systemctl reload nginx"
If it returns a permission error, add the sudoers rule as described in SSH user permissions.
Nginx doesn't apply the new certificate after the deploy
Confirm that the virtual host points to the same paths configured in the store:
nginx -t && systemctl reload nginx
Also check that Nginx is active:
systemctl status nginx