Skip to main content

NGINX

SecTrail CM establishes agent-less connections to NGINX web servers to enable automatic deployment and renewal of SSL certificates.

Connection Requirements​

RequirementDetailDescription
ProtocolSSH (Secure Shell)Secure remote connection protocol
Port22Standard SSH port or custom port
AuthenticationSSH Key or PasswordAuthentication with SSH key or password
User PermissionConfiguration read/write permissionAccess and edit permission for NGINX config files

Automatic Operations​

SecTrail CM automatically performs the following operations on NGINX:

  1. Certificate and Key Upload: Secure transfer of SSL certificate, private key, and chain file
  2. Configuration Update: Updating NGINX Server Block SSL directives
  3. Configuration Test: Syntax check and validation
  4. Service Reload: Seamless reloading of NGINX service

Configuration Steps​

1. Create NGINX Linux User​

Navigate to Automation > Device Users and create a user for NGINX.

2. Add NGINX Device to SecTrail CM​

Click Automation > Devices > Add New Device button and enter the following information:

Add NGINX Device

  • Name: Give a descriptive name for the device
  • Device Users: Select the user you created in Step 1
  • IP: Enter the IP address of the NGINX server
  • Device Type: Select Nginx from the dropdown menu
  • Become Method: Select privilege escalation method (e.g., sudo)
  • Custom Path: Enter the path to the NGINX binary file (e.g., /usr/sbin/nginx)
Automatic Discovery

After the NGINX device is added to SecTrail CM, IP addresses and ports of all Server Blocks defined on the device are automatically included in the discovery period and regularly scanned.

3. View Device Information​

After adding a device, it will be displayed in the Automation > Devices list. Click on the row to view device details:

NGINX Device Details and Server Block List

  • Server Name: Server block server name (e.g., sectrailcm-test.borsaistanbul.com)
  • Port: Ports NGINX is listening on (e.g., 8443)
  • Path: NGINX configuration file path (e.g., /etc/nginx/conf.d/domain_nginx.conf)
  • Server: SSL configuration details
  • Deploy: For certificate deployment

Certificate Deployment​

Step 1: Server Block and Certificate Selection​

  1. Select your NGINX device from the Automation > Devices section
  2. In the device details, find the Server Block you want to deploy a certificate to
  3. Click the Deploy button on the relevant row
  4. In the Deploy Certificate window that opens:
    • Virtual Servers: Target Server Block information is displayed (IP, port, server name)
    • Certificate: Select the certificate you want to deploy from the dropdown menu

Certificate Deployment Screen

Step 2: Start Deployment Process​

Click the Deploy button to start the certificate deployment process.

Step 3: Process Tracking​

The deployment process can be tracked from the Automation > Processes section:

NGINX Deployment Processes

Process Details​

The following steps are performed during deployment:

StepProcess Description
1Certificate, key, and chain files are uploaded to the server
2Current certificate files are backed up
3New certificate configuration is applied
4NGINX service is reloaded

Rollback Process​

If problems occur after certificate deployment, the Manual Rollback feature can be used.

Automatic Rollback

If an error occurs during any step of the deployment process, the system automatically performs the rollback operation and all changes are reverted.

Rollback Steps​

  1. Navigate to Automation > Processes
  2. Find the process you want to roll back
  3. Use the Manual-Rollback option in the Status column
  4. Confirm

Operations During Rollback​

StepOperation
1New configuration is removed
2Backed up certificate files are restored
3Newly uploaded certificate, key, and chain files are deleted
4NGINX service is reloaded