nginx for dummies? How to enable Jenkins over https

Question

I'm running Jenkins on an Ubuntu machine bare metal, and as I'm only experimenting and learning how the ops of it all works, I now want to learn how to enable https (with a nominally valid certificate obviously). I want to talk to a git instance and other tools and keep the automation tools secure. I believe the easiest is to use a reverse proxy, NGINX. Which I assume just acts like a forwarder; this is where I get stuck as a newbie.

I am unable to set up or follow the nginx initial steps to obtain a certificate, because the key generation tool (keytool) just does nothing when I give it a URL. It keeps saying my computer's FQDN is not valid.

I guess that's because my ubuntu machine is behind a NAT. I am guessing it's not realistic to create a trusted server on a private LAN which only has egress, but no ingress? Do I really need a real domain? I have one, but since this is work related, I'm loathe to create any kind of link-up between work and play. This feels a little workaround hacky-like, so keen for alternatives to what looks like an overkill configuration. For an internal experimental Jenkins setup, is there a 3 step process that a beginner who knows very little about keys can follow?

Answer 1

Your question is very broad, but I'll try to answer it.

1. You really need to read on what TLS/SSL is and how it works before you continue. You can find a bunch of questions in security.stackexchange.com that ask about this and many of them even link to RFCs where you can read the full detailed explanations of how it all works.

2. To configure nginx to work with TLS/SSL certificate you can use https://www.digitalocean.com/community/tools/nginx to generate the template. Just follow the guide and it should create a relatively secured vhost. If you would like to enhance the security even further - you can follow cipherli.st's guide. They update it relatively often so the proposed settings are usually up-to-date.

3. What makes a certificate "valid" or "invalid"? It's the Certificate Authority. It is possible to create a private CA certificate and use it to sign a Certificate Signing Request (or CSR). The CSR can then be signed by the CA and returned to whoever needs it (in this case the Nginx server). There are multiple tutorials for this available online and you can use easy-rsa to do the heavy lifting. However, the down side of doing it this way is that you need to go over all machines in the network and install the CA in browsers and all necessary keystores. Otherwise those machine will treat the site's certificates as "untrusted" because it will be coming from an unknown Certificate Authority. In some cases you can also create a Certificate Bundle for nginx.

   

4. If you had an ingress available you could have used LetsEncrypt to automatically issue certificates and skip complicating your setup by having CA and issuing certificates on your own.

Note: Image has been borrowed from ssl.com.